Biometrics system, biologic information storage, and portable device

ABSTRACT

In a biometrics system for a building entrance unlocking or a bank account authentication, reference information registered under administration by the system is transmitted to a room or mobile-phone for private storage, with the original reference information deleted from the system. Biologic information gotten upon authentication is transmitted through wireless system to the room or mobile-phone for comparison with the reference, the result being returned to the system. Or, the reference is tentatively sent back to the system for comparison with the gotten biologic information. The biologic information sent to mobile-phone also includes health control information for storage and display. Mobile-phone also can receive blood pressure information at a waiting lounge of medical institution though wireless local communication even if the main power shut down. The communication between the biometrics system and the mobile-phone is encrypted. The system includes sensor unit and protection unit, the abnormality thereof being separately checked.

CROSS REFERENCE TO RELATED APPLICATION

This application is a Continuation Application of U.S. application Ser.No. 11/627,962 filed Jan. 27, 2007, herein incorporated by reference inits entirety.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates to a biometrics system for authenticating aperson on the basis of biologic information. This invention also relatesto a biologic information storage and to a portable device such as amobile-phone.

2. Description of the Related Art

In this field of the art, various biometrics systems have been proposedfor blocking an imposter upon authentication, or for realizing an easyauthentication. On the other hand, Japanese Laid-open Patent Application2004-344375 proposes to make use of biologic information obtained forthe purpose of authenticating a person to also look after health of theperson.

Since biologic information is important private information, however,authentication with biologic information may cause problems of privacyviolation.

SUMMARY OF THE INVENTION

The object of this invention is to provide a biometrics system in whichsecurity in authentication is enhanced with privacy protection carefullyconsidered.

Another object of this invention is to provide a biologic informationstorage for storing biologic information for authentication or forhealth control.

Further object of this invention is to provide a portable device such asa mobile-phone useful for biometrics or health control.

To achieve one of the above objects, this invention provides abiometrics system for attaining an object, such as an entrance unlockingor a bank account authentication, by means of authenticating a personthrough a comparison between biologic information gotten by the personand registered reference biologic information of the person. Thebiometrics system comprising an administrator arranged to administratethe registration of the reference biologic information of the person anda transmitter, such as a wireless local communication apparatus,arranged to transmit the registered reference biologic information to anoutside device under private control by the person to have the outsidedevice store the registered reference biologic information.

According to the above feature of this invention, the reference biologicinformation is prevented from being forged since the registration of thereference biologic information is only possible under administration ofthe biometrics system. On the other hand, the reference biologicinformation once registered is transmitted to an outside device, such asa biologic information storage or a portable device, which is underprivate control by the person to keep privacy of the registeredreference biologic information.

The biometrics system according to a detailed feature of this inventionabove further comprises a controller arranged to delete the registeredreference biologic information from the biometrics system after thetransmission of the registered reference biologic information to theoutside device. Thus, the privacy protection is strengthened.

The biometrics system according to another detailed feature of thisinvention above further comprises a second transmitter arranged totransmit to the outside device a biologic information gotten from aperson, a receiver arranged to receive a result of comparison betweenthe transmitted biologic information and the registered referencebiologic information from the outside device, and function part arrangedto attain the object in accordance with the result of comparisonreceived by the receiver. Thus, there is no necessity for the biometricssystem to keep the reference biologic information, which is advantageousfor privacy protection.

In the case that the biometrics system according to this invention aboveis applied to a lock control system for an entrance door commonlyutilized by a plurality of persons, the outside device is underindividual control of one of the persons utilizing the entrance.

In the case that the biometrics system according to this invention aboveis applied to a bank system for authenticating a customer of the bank,on the other hand, the outside device may be a portable device, such asa mobile-phone, carried by the customer.

The biometrics system according to a different type of detailed featureof this invention above further comprises a receiver arranged totemporarily receive the registered reference biologic information fromthe outside device every time when needed, a comparator arranged tocompare a biologic information gotten from a person and the registeredreference biologic information, and function part arranged to attain theobject in accordance with the result of comparison by the comparator. Inthis case, the outside device has no need of being informed of biologicinformation gotten from a person upon authentication, nor has anycomparison function by itself, but simply keeps the reference biologicinformation. The biometrics system, on the other hand, does notpermanently keep the reference biologic information in consideration ofprivacy protection.

This invention also provides a biometrics system for attaining an objectby means of authenticating a person through a comparison betweenbiologic information gotten by the person and registered referencebiologic information of the person, which comprises a biologicinformation sensor arranged to sense biologic information includingbiometrics information and health control information, and atransmitter, such as a wireless local communication apparatus, arrangedto transmit the biologic information sensed by the sensor to an outsidedevice to have the outside device store the biologic information as thehealth control information.

According to the above feature of this invention, the biologicinformation of a person is sent to the outside device every time withoutfail when the authentication of the person is made. In other words, theoutside device stores the health control information in natural responseto the authentication. Thus, the outside device can easily and regularlyaccumulate the health control information of the person even if theoutside device by itself has no biologic information sensor, which issometimes of high performance requiring high cost for a high reliabilityof authentication. For example, the outside device is under control of amedical institution for a sophisticated health care. Or, the outsidedevice is a portable device under private control by the person, such asa mobile-phone.

According to the detail of the feature of this invention above, thelevel of sufficiency of the biologic information may differ between acase for authentication by the biometrics system and a case for storageby the outside device. For example, this makes it possible for thebiometrics system to complete the authentication even if the level ofthe biologic information is insufficient for the purpose of the storageby the outside device.

According to the detail of the feature of this invention above, thetransmitter is arranged to transmit the biologic information to theoutside device when the biometrics system succeeds in authenticating theperson on the basis of the biologic information sensed by the sensor. Inmore detail, the transmitter may be arranged to transmit the biologicinformation to the outside device under private control by the personauthenticated through the biologic information.

This invention also provides a biologic information storage for storinga reference biologic information for use in a biometrics system ofattaining an object by means of authenticating a person through acomparison between biologic information gotten from the person and thereference biologic information of the person. The biologic informationstorage comprises a receiver arranged to receive the reference biologicinformation from the biometrics system, a storage part arranged to storethe received reference biologic information, and a communicator arrangedto communicate with the biometrics system for utilizing the referenceinformation upon authentication. The biologic information storagecorresponds to the outside device explained above, the various detailsand advantages of which are not necessary to be repeated.

This invention also provides a portable device, such as a mobile-phone,for storing health control information of a person carrying the potabledevice comprising a receiver, such as a wireless local communicationapparatus, arranged to receive the health control information from anoutside biologic information sensor, a storage part arranged to storethe received health control information, and a display arranged todisplay health control information on the basis of the storage part.

According to the above feature of this invention, the portable devicecan easily accumulate the health control information of a personcarrying the portable device for display on it even if the portabledevice by itself has no biologic information sensor, which is sometimesof high performance requiring high cost. For example, a mobile-phoneaccording to the invention above can receive and store blood pressureinformation from a high performance of automatic blood pressure monitorlocated at a waiting lounge of medical institution if such a bloodpressure monitor has a suitable information transmitter, such as awireless local communication apparatus.

According to the detail of the feature of this invention above, thewireless local communication apparatus is activated even if themobile-phone communication apparatus is deactivated. Thus, themobile-phone can receive the health control information from the outsidebiologic information sensor, such as the automatic blood pressuremonitor, even if the main power switch of the mobile-phone is shut downin compliance with the instruction of medical institution.

This invention also provides a biometrics system for attaining an objectby means of authenticating a person through a comparison betweenbiologic information gotten by the person and registered referencebiologic information of the person, which comprises an encryptionsystem, an administrator arranged to administrate the registration ofthe reference biologic information of the person with the encryptionsystem utilized, the encrypted reference biologic information beingstored by an outside device, a biologic information sensor arranged tosense biologic information of the person to be authenticated, and atransmitter arranged to transmit to the outside device the biologicinformation sensed by the sensor with the encryption system utilized,whereby the encrypted biologic information gotten form the person andthe encrypted reference biologic information are compared at the outsidedevice.

According to the above feature of this invention, various advantages areattainable by means of the combination of the biometrics and theencryption system. Firstly, an imposter upon authentication is blockedby means of the biometrics system. Secondly, various signals exchangedbetween the biometrics system and the outside device through a wirelesslocal communication apparatus or the like are prevented from beingforged by means of the encryption system. Thirdly, a possible outflow ofthe reference biologic information through the biometrics system isprevented by means of the encryption system.

This invention also provides a biometrics system for attaining an objectby means of authenticating a person through a comparison betweenbiologic information gotten by the person and registered referencebiologic information of the person, which comprises a biologicinformation sensor unit arranged to sense biologic information of theperson, a protection unit separable from the biologic information sensorunit arranged to prevent the biologic information sensor unit from beingdamaged, and a controller arranged to separately check the biologicinformation sensor unit and protection unit, respectively, for detectingabnormal condition thereof.

According to the above feature of this invention, the biologicinformation sensor unit of a sensitive nature is prevented from beingdamaged by means of the separable protection unit, the abnormalcondition of both the units being separately checked. Thus, theprotection unit if vandalized or tainted can be promptly detected forreplacement thereof, and the biologic information sensor unit if out oforder by itself can be distinctly detected. roller 53 checks whether ornot sensor unit 51 is working correctly.

Other features and advantages according to this invention will bereadily understood from the detailed description of the preferredembodiments in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a biometrics and health controlling systemaccording to a first embodiment of this invention.

FIG. 2 is a block diagram of a blood vessel sensor system for the firstembodiment.

FIG. 3 is a block diagram representing the detailed structure ofcondominium building entrance lock control system for the firstembodiment.

FIG. 4 is a flow chart of the basic function of the personal computerlocated in a condominium apartment.

FIG. 5 is a flow chart showing the detail of step 12 in FIG. 4.

FIG. 6 is a flow chart of the personal computer located in thecondominium apartment with the authentication system triggered at theentrance door of the condominium apartment for the first embodiment.

FIG. 7 is a flow chart of the personal computer located in thecondominium apartment with the authentication system triggered at theentrance of the condominium building for the first embodiment.

FIG. 8 is a flow chart showing the details of step 47 in FIG. 6 and step68 in FIG. 7 for the first embodiment.

FIG. 9 is a basic flow chart of the personal computer located in theadministration center of the condominium building for the firstembodiment.

FIG. 10 is a flow chart of the personal computer located in theadministration center of the condominium building with theauthentication system triggered at the entrance of the condominiumbuilding for the first embodiment.

FIG. 11 is a flow chart of the basic function of the personal computerlocated in the medical institution for the first embodiment.

FIG. 12 is a flow chart regarding the data transmission process of thepersonal computer in the medical institution for the first embodiment.

FIG. 13 is a flow chart showing the details of step 134 in FIG. 11 forthe first embodiment.

FIG. 14 is a block diagram of a biometrics and health controlling systemaccording to a second embodiment of this invention.

FIG. 15 is a flow chart showing the details of step 11 in FIG. 4 for thefirst embodiment.

FIG. 16 is a flow chart showing the details of step 110 in FIG. 9 forthe first embodiment.

FIG. 17 is a flow chart of the personal computer located in thecondominium apartment with the authentication system triggered at theentrance of the condominium building for the third embodiment.

FIG. 18 is a flow chart of the personal computer located in theadministration center of the condominium building with theauthentication system triggered at the entrance of the condominiumbuilding for the third embodiment.

FIG. 19 is a flow chart showing the details of step 12 in FIG. 4 for thefirst embodiment.

FIG. 20 is a flow chart showing the details of step 84 in FIG. 8 for thefirst embodiment.

FIG. 21 is a schematic view of a structure of an entrance door for thefirst to fourth embodiments.

FIG. 22 is a chart showing a structure of biometric recognition data andhealth administration data for the fifth embodiment.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS First Embodiment

FIG. 1 is a block diagram of a biometrics and health controlling systemaccording to a first embodiment of this invention, which is embodied ina condominium building where a plurality of families domicile.

Condominium building 1 in FIG. 1 includes the first apartment 2 for thefirst family, the second apartment 3 for the second family and the thirdapartment 4 for the third family with rest apartments in fact includedin condominium building 1 omitted for simplification of the figure. Thefirst personal computer 5 controls the entire system in the firstapartment 2, the detailed structure of which will be explained later.The second apartment 3 and the third apartment 4 each are of the samestructure, which is not shown except for the second personal computer 6and the third personal computer 7 for controlling the entire systems ofthe apartments, respectively. Detailed explanation of these apartmentsis also omitted for avoiding duplication.

According to the system of the first embodiment, each of apartments 2, 3and 4 is in cooperation with condominium building entrance lock controlsystem 8 and with medical institution 9, the details of which will beexplained later.

A personal computer such as the first personal computer 5 is hereinafterexplained as a controller in the apartment. In place of such ageneral-purpose personal computer, however, an exclusive use computerfor the system may be provided for the apartment in practicing thisinvention. Further, adoption of any other controlling means is possibleif it has the similar function.

Entrance door 10 of the first apartment 2 is provided with door lock 11that automatically locks entrance door 10 upon every closure thereof.The first personal computer 5 controls whether or not to unlock entrancedoor 10 from the outside. For this purpose, controller 12 of the firstpersonal computer 5 receives biologic information of a person, who isgoing to unlock entrance door 10, from home biologic information sensor13 to compare the received information with a reference biologicinformation previously registered in reference biologic informationholder 14. In response to the comparison, the first personal computer 5sends unlock signal to door lock 11 if the person is authenticated asone who is entitled to enter the first apartment 5.

In more detail, home biologic information sensor 13 includes a bloodvessel sensor for optically detecting information of blood vessel insidea human finger inserted into a predetermined position. Controller 12receives blood information from the blood vessel sensor for extracting apattern of blood vessel to determine whether it is identical with one ofreference blood vessel patterns of previously registered family membersin reference biologic information holder 14. And, the first personalcomputer 5 sends unlock signal to door lock 11 if the extracted bloodpattern is identical with the one of the family members entitled toenter the apartment 4.

The information of the finger blood vessel sensed by home biologicinformation sensor 13 includes not only blood vessel patterninformation, but also plethysmogram information due to artery pulsationin the human finger. Controller 12 gets from plethysmogram informationthe blood component information such as oxygen saturation or informationof blood vessel youth, for example. Since such information as bloodcomponent and blood vessel youth is useful for individual healthcontrol, controller 12 sends it to individual health control database 15for storage therein with respect to every parson authenticated.

Controller 12 compares the blood component information or blood vesselyouth information with reference information individually stored inreference health information holder 16. Reference health informationholder 16 holds not only instantaneous value of the referenceinformation but also change in it over time. Thus, controller 12 notonly compares instantaneous value of the information sensed by homebiologic information sensor 13 with the instantaneous value of thereference information held by reference health information holder 16.But also, controller 12 compares the change in information sensed byhome biologic information sensor 13 and stored in individual healthcontrol database 15 with the reference change information held in healthinformation holder 16. Thus, the health control is possible also in viewof the speed of the change in information sensed by home biologicinformation sensor 13 over time. The results of comparison between theinstantaneous values of information and of the comparison between thechanges in information are displayed on the monitor of television set17. In case of such a display on the monitor of television set 17, it isadvantageous to make such an indication as “ABNORMALITY” automaticallyfollow the turning on of the television set 17 in dependence of theresult of the comparison showing the abnormality.

In displaying the results of comparison, a person even in a family mayexpect his or her privacy to be respected. For such privacy, in place ofthe television set 17, a mobile-phone kept by each person in the familymay be used to receive the results of the comparison. Thus, each personis capable of confirming personal health by watching the display of ownmobile-phone on every entry into the apartment. An application of thisinvention to a mobile-phone will be explained later in more detail withrespect to the second embodiment.

As in the above, home biologic information sensor 13 according to theinvention has dual functions of authenticating a person for unlockingthe door and of getting information of health control of the sameperson. Therefore, first personal computer 5 normally sends the unlocksignal to door lock 11 when succeeding in both authenticating a personand getting the health control information of the person.

First personal computer 5 also sends the unlock signal to door lock 11when succeeding in authenticating a person even if failing in gettingsufficient health control information of the person. This is because theentry control, which is the primary object, is attained when the personauthentication has been successfully completed for the purpose ofunlocking the door. However, the person under authentication forunlocking the door expects that the health control information is gottenat the same time. Therefore, in the case of failing in getting healthcontrol information, a caution is made to inform the person of thefailure and its reason. At hearing or watching such a caution, theperson may again insert his or her finger into home biologic informationsensor 13 if the person prefers to try again to get health controlinformation. Or, the person may promptly enter the first apartment 2with the reason of the failure in mind for improving the manner ofinserting his or her finger for the next time.

As home biologic information sensor 13, a funduscopic sensor forexamining the eye-fundus image is applicable in place of the bloodvessel sensor for optically detecting information of blood vessel. Theeye-funcus image, which also includes both retina pattern forauthentication and health control information, can serves as the sensoraccording to this invention as in the case of blood vessel image. Avoice sensor for examining the vocal print, which also capable ofgetting both authentication and health control information, is stillanother example of home biologic information sensor 13 of thisinvention. In the case of checking the voice, it is possible to add abreath component sensor for breath alcohol testing in combination withthe voice sensor, which can check the correlation between drinking andthe health.

Any type of sensor other than the types mentioned above is possible tobe used in this invention as home biologic information sensor 13provided that such a type is capable of both authenticating a person andgetting health controlling information of the person. For example, notonly the above mentioned noncontact type sensors but also a contact typesensor for the skin is applicable. Further, not only sensors detectinglight or sound, but also an electric sensing system for passing a weakelectric current through living body to probe a response signal. Inplace of selecting a suitable single type of sensor, a plurality ofdifferent types of sensors can be combined for improving degree ofaccuracy as well as increasing a variety of health control information.

Further, not only the case of combining sensors each capable of both theauthentication and the health controlling information getting, but alsoa case is possible in which one of such dual function sensors incombined with a single function sensor capable of only authentication orhealth controlling information getting. For example, an image sensor forprocessing the image to interpret body temperature may be combined withone of the dual function sensors. Or a finger pattern sensor forauthentication may be combined with one of the dual function sensors.

Home biologic information sensor 13 is satisfactory if it has the dualfunction as a whole. In other word, home biologic information sensor 13dose not necessarily require a sensor with the dual function, but acombination of a sensor with only authentication function and anothersensor with only health controlling information getting function issatisfactory. Further, the point of this invention is to automaticallyget health controlling information upon authentication. So, not onlybiometrics system, but also a conventional authenticating system such aspassword system or IC card system can be adopted in this invention withsuitable measures taken for naturally getting health controllinginformation upon authentication by such a conventional system.

The first personal computer 5 further includes user authenticationsensor 18 for authenticating a user who is entitled to access the firstpersonal computer 5. User authentication sensor 18 includes thebiometrics system capable of getting finger blood vessel information ashas been explained in the case of home biologic information sensor 13.User authentication sensor 18 further includes a sensor typical of apersonal computer such as a sensor arranged at the mouse of the firstpersonal computer 5 for getting blood vessel pattern of a palm graspingthe mouse. Such a palm blood vessel sensor at the mouse can perform thebiometrics check not only at the initial access to the first personalcomputer 5, but also the sensor can repeat it during operation of thefirst personal computer 5 by the user. In other words, it is possible tocontinuously monitor health control information of the user throughoutthe entire period of using the first personal computer 5. Thus, thisinvention in also applicable to a case of authenticating the user who isentitled to access a personal computer.

Procession of the signal from user authentication sensor 18 andcomparison of the sensor signal with the reference signal registered inreference biologic information holder 14 for authentication are similarto those explained with respect to home biologic information sensor 13.Further, comparison of the sensor signal with the reference signalregistered in reference health information holder 16 for health controland storage of the sensor signal into in individual health controldatabase 15 are also similar to those explained with respect to homebiologic information sensor 13. Further explanation on userauthentication sensor 18 is accordingly omitted for avoidingduplication, except for the following comment. Namely, it is typical tothe case of user authentication sensor 18 that controller 12 allows auser to access to the first personal computer 5 when the user isauthenticated as a result of the comparison of the signal from userauthentication sensor 18 with the reference signal registered inreference biologic information holder 14.

In addition to the above described authentication for unlocking doorlock 11 of entrance door 10 and for accessing the first personalcomputer 5, the first personal computer 5 has a function ofcommunicating with administration computer 19, which is a personalcomputer located in condominium building entrance lock control system 8of condominium building 1 to control the same in the first embodiment.

Condominium building entrance lock control system 8 includes entrancelock 20, which is automatically locked every after the entrance isclosed. The unlocking of the entrance from the outside is made possibleunder control of administration computer 19. Condominium buildingentrance lock control system 8 includes commercial grade biologicinformation sensor 21 for authenticating a person who wants to enter theentrance of condominium building 1. Commercial grade biologicinformation sensor 21 sends the sensed information of the person toadministration computer 19, which in turn sends the received informationto every personal computer of the apartment which joins condominiumbuilding entrance lock control system 8. In the case of FIG. 1, theinformation sensed by commercial grade biologic information sensor 21 isreceived by administration computer 19, and is in turn sent to the firstpersonal computer 5 of the first apartment 2, to the second personalcomputer 6 of the second apartment 3 and to the third personal computer7 of the third apartment. Further, if there are other personal computersof other apartments which each join condominium building entrance lockcontrol system 8, administration computer 19 also send the receivedinformation to such personal computers. Commercial grade biologicinformation sensor 21 not only has the same function as of home biologicinformation sensor 13, but also has other high grade additional sensingfunctions.

Under the situation above, the first personal computer 5 of the firstapartment 2 compares the information sensed by commercial grade biologicinformation sensor 21 with the reference information registered inreference biologic information holder 14. As a result of such acomparison, if the first personal computer 5 authenticates that theperson at the entrance is entitled to enter the condominium building 1,the first computer 5 inform administration computer 19 of the result. Inresponse to such an authentication by the first personal computer 5,administration computer 19 sends an unlock signal to entrance lock 20.On the other hand, if the information from administration computer 19fails to coincide with the reference at the first personal computer 5,it informs administration computer 19 of such a result of failure. Inthis case, administration computer 19 is not caused to send any unlocksignal to entrance lock 20 by at least the first personal computer 5.

The similar cooperation is made between administration computer 19 andother every personal computer of apartment that joins condominiumbuilding entrance lock control system 8, such as the second personalcomputer 6 of the second apartment 3 and the third personal computer 7of the third apartment or the like. Administration computer 19 sends anunlock signal to entrance lock 20 if informed of a successfulauthentication by at least one personal computer. On the other hand, ifall the personal computers inform administration computer 19 of thefailure in coincidence of the sensed information with the reference,administration computer 19 does not send any unlock signal to entrancelock 20 at all. Instead, administration computer 19 causes an admissionrefusal indication at the entrance.

Even in a case of no response from some of apartments, administrationcomputer 19 does not send any unlock signal to entrance lock 20 if allof the rest of the apartments inform administration computer 19 of thefailure in coincidence of the sensed information with the reference. Inthis case, administration computer 19 also causes an admission refusalindication at the entrance. If a person really entitled to entercondominium building 1 requires the authentication and faces to such anadmission refusal indication, the person can know that something iswrong with the system relating to the apartment he or she is going toreach. Then, he or she may enter condominium building 1 by unlockingentrance lock 20 with an auxiliary conventional authentication system,such as password system or IC card system for the time being. The personis also informed of the necessity of system recovery by the admissionrefusal indication.

The admission refusal indication includes no information of the reason.In other words, no one other than the person entitled to entercondominium building 1 knows whether all the personal computers informadministration computer 19 of the failure in coincidence of the sensedinformation with the reference or something is wrong with the systemrelating to the apartment he or she is going to reach. Further, evenadministration computer 19 cannot identify individual apartment whichsends its response, but can only determine whether or not one of theapartments informs administration computer 19 of the coincidence of thesensed information with the reference. Thus, privacy relating to thereference information of each apartment is kept.

As is apparent from the above, administration computer 19 of condominiumbuilding entrance lock control system 8 itself has no function ofstoring private reference information of person in each apartment orcomparing the sensed information with the private reference information,but has the function of only receiving the result of the comparisonreported from each apartment. By this consideration, the referenceinformation relating to privacy such as the blood vessel pattern or theeye-fundus pattern is kept within the apartment. Further, administrationcomputer 19 having no function of comparison of the information norknowing the origin of the comparison result cannot identify the personwhose information is sensed by commercial grade biologic informationsensor 21. Thus, privacy of the person who wants to enter condominiumbuilding is kept.

Commercial grade biologic information sensor 21 as well as home biologicinformation sensor 13 can get not only the information of authenticationbut also the information of health control. Therefore, commercial gradebiologic information sensor 21 can performs the same health controlfunction as in home biologic information sensor 13 explained above. Themanner of processing the signal from commercial grade biologicinformation sensor 21, the comparison of the signal from commercialgrade biologic information sensor 21 with reference informationregistered in reference health information holder 16, and the storage ofthe health control information in individual health control database 15are similar to the corresponding functions explained in relation to homebiologic information sensor 13. So, further explanation is omitted.

As has been mentioned above, commercial grade biologic informationsensor 21 is of common functions to those in home biologic informationsensor 13 with higher functions added. Reference biologic informationholder 14, reference health information holder 16 and individual healthcontrol database 15 are prepared for such higher functions of commercialgrade biologic information sensor 21.

The functions of commercial grade biologic information sensor 21 incommon with home biologic information sensor 13 are useful for doublechecking the same health control information. For example, commercialgrade biologic information sensor 21 at the entrance of condominiumbuilding 1 initially gets health control information of a person who isgoing to the first apartment 2, and home biologic information sensor 13at entrance door 10 gets the same health control information of the sameperson again. Thus, the reliability of the gotten health controlinformation is improved.

Further, the correlation between the same health control informationgotten at the entrance of condominium building 1 and at entrance door10. For example, if the health control information is gotten at theentrance of condominium building 1 with the person in normal conditionand the same health control information is gotten at entrance door 10with the same person reaching there by stairs, the correlation of thehealth control information between the normal condition and a conditionunder exercise stress can be checked. The degree of exercise stress canbe taken in through checking pulsation.

On the other hand, if a person walking uphill to reach the entrance ofcondominium building 1, the health control information of the personsuffering the exercise stress is gotten by commercial grade biologicinformation sensor 21. And, if the person recovering to the normalcondition by using an elevator up to his or her apartment, home biologicinformation sensor 13 can get the same health control information fordiagnosing the resilience.

Thus, the combination of the health control information gotten at theentrance of condominium building 1 and at entrance door 10 withlifestyle of inhabitant of condominium building 1 naturally taken intoconsideration makes it possible to gather fruitful health controlinformation data.

Health condition is apt to be influenced by climate conditions such asseason, temperature, humidity, and wind velocity. Therefore, homebiologic information sensor 13 and commercial grade biologic informationsensor 21 each have functions of recording date and time as well assensors for such climate conditions to get further fruitful healthinformation data. Especially, commercial grade biologic informationsensor 21, which is located at the entrance of condominium building inan outdoor, is suitable to get such climate conditions. Further,temperature and humidity sensed by commercial grade biologic informationsensor 21 outside condominium building 1 differ from those sensed byhome biologic information sensor 13 within condominium building 1. Thismakes it possible to compare the same health control information itemgotten under different temperature and humidity.

As has been explained, the cooperation between the first apartment 2 andcondominium building entrance lock control system 8 has to be similarlydone between the second apartment 3 and condominium building entrancelock control system 8 and between the third apartment 4 and condominiumbuilding entrance lock control system 8 or the like. So, the system ineach apartment is administrated in accordance with the common standardwithin the condominium building. And, the system in each apartment ischecked upon moving in of a new inhabitant. Further, if the version ofcondominium building entrance lock control system 8 is upgraded, thesystems of all th apartment in condominium building 1 arecorrespondingly upgraded into the new version.

If an inhabitant moves out condominium building 1, the contents ofreference biologic information holder 14, individual health controldatabase 15 and reference health information holder 16 are desired to becarried over into a new residence, though unlocking information peculiarto the old residence should be abandoned. Therefore, at least the healthcontrol system using the contents of reference biologic informationholder 14, individual health control database 15 and reference healthinformation holder 16 are administrated on a universal standard.

The explanation is advanced to the cooperation between medicalinstitution 9 and the apartment in condominium building 1. The firstpersonal computer 5 of the first apartment 2, for example, is incommunication with host computer 22 of medical institution 9 forexchanging information. For the purpose of keeping security, theinformation is exchanged in cipher and the authentication of the patientin medical institution 9 is carefully done by means of the biometricssystem utilizing user authentication sensor 18 of the first personalcomputer 5.

Reference health information in reference health information holder 16of the first personal computer 5 is registered at reference biologicinformation register 23 of host computer 22 when the inhabitant ofcondominium building 1 visits medical institution 9. In other words, theinhabitant visiting medical institution 9 as a patient consults with anautomatic diagnostic system for self-testing his or her health controlinformation in accordance with the instruction given by biologicinformation comparing software 24 to automatically register the resultas the reference health information. The diagnosis may be different fromeach other even if the value of the health control information itself isthe same. So, doctor 25 further gives a face-to-face diagnosis to modifythe automatically gotten reference health control information ifnecessary. In this case, the doctor-modified reference health controlinformation is marked to be distinguished from the automatically gottenreference health control information for taking it into considerationupon comparison with the sensed information.

Thus registered reference health control information of the patient issent to the first personal computer 5 under administration by hostcontroller 26 to be stored into reference health information holder 16.Further a pert of biologic information comparing software 24 necessaryfor the first personal computer 5 to handling the reference healthcontrol information is sent to the first personal computer 5 to beinstalled into controller 12.

Information gotten by home biologic information sensor 13, commercialgrade biologic information sensor 21 and user authentication sensor 18as they are, as well as those stored in individual health controldatabase 15, are sent from the first personal computer 5 to hostcomputer 22 in real time to be stored into central health controldatabase 27.

Also, the result of comparison between the sensed information and thereference in reference health information holder 16 is sent from thefirst personal computer 5 to host computer 22 as supplementalinformation. Though the comparison between the sensed information andthe reference is possible at host computer 22 under control of biologicinformation comparing software 24, it is helpful for host computer 22 tobe informed of the result of comparison done by the first personalcomputer 5. A comparison of high level health control information is, ofcourse, conducted by host computer 22 exclusively on the basis of thesensed information sent from the first personal computer 5 under controlof biologic information comparing software 24. Such comparison result isalso stored into central health control database 27.

The sensed health control information or the result of the comparison ofit with the reference with respect to every patient stored in centralhealth control database 27 is outputted on a regular schedule at doctordiagnosis interface 28 available to doctor 25. Doctor 25 inputs his orher diagnosis at doctor diagnosis interface 28 for storage into centralhealth control database 27

The comparison result automatically made by biologic informationcomparing software 24 or diagnosis made by doctor 25 is sent on aregular schedule to the first personal computer 5, which can be viewedon a monitor of the first personal computer 5 of television set 17.

If the result by biologic information comparing software 24 or diagnosisby doctor 25 indicates an emergency, an alert is generated in a promptmanner from host computer 22 for informing the first personal computer 5of it.

The above mentioned cooperation between medical institution 9 and thefirst apartment 2 is also made between medical institution 9 and each ofother apartments such as the second apartment 3 or third apartment 4 incondominium building 1. For keeping such a total system, all theapartments in condominium building 1 is administrated in accordance witha common standard not only applicable to condominium building 1, butalso to an entire system including medical institution 9.

Central health control database 27 of medical institution 9 storeshealth control information of variety of patients, which makes itpossible to statistically process such health control information. Thismeans that medical institution 9 can provide a specific patient with hisor her position in view of the statistics, such as average ordistribution. Further, medical institution 9 can decide in an evenhandedfashion whether health control information of a specific patient iswithin or out of a normal range of the average or distribution. Medicalinstitution 9 makes a service of delivering such statistics informationto the first personal computer 5 or the like. Of course, medicalinstitution 9 highly keeps privacy of individual patients in handlingthe health control information in the statistics procession.

Biologic information comparing software 24 of medical institution 9deeply relates to the information getting function of home biologicinformation sensor 13, commercial grade biologic information sensor 21and user authentication sensor 18. So, if any of such sensors isreplaced by new one with a changed or an improved function atcondominium building 1, a corresponding maintenance of biologicinformation comparing software 24 should be done at medical institution9. For this purpose, host computer 22 of medical institution 9 keepscontact with the first personal computer 5, the second personal computer6 and the third personal computer or the like in each apartment as wellas administration computer 19 of condominium building entrance lockcontrol system 8 to mutually do necessary software maintenance.

On the other hand, medical institution 9 may propose an improved sensorfor use in home biologic information sensor 13, or commercial gradebiologic information sensor 21 or user authentication sensor 18 inaccordance with a new service system that medical institution 9 is goingto propose for its business. In this case, medical institution 9provides such an improved sensor as well as driver software for such asensor. Or, medical institution 9 provides an improved sensor and driversoftware thereof without extra charge every time when the service systemis improved on a general maintenance agreement.

Because of movement or some other reason, a patient may change medicalinstitution 9 into new one closer to the new residence or with otherconvenience. In this case, the patient may want his or her healthcontrol information stored in central health control database 27 to betaken over by the new medical institution. Therefore, health controlinformation stored in central health control database 27 is handled inaccordance with a common standard so that the health control informationwill be continuously valid even if the medical institution is changed.

FIG. 2 is a block diagram of a blood vessel sensor system for the firstembodiment. The blood vessel sensor system such as in FIG. 2 is used ashome biologic information sensor 13, commercial grade biologicinformation sensor 21 and user authentication sensor 18 for gettinginformation for biometrics and health control. In FIG. 2, however, theblood vessel sensor system is specifically shown as home biologicinformation sensor 13 for example. The same numeral is used foridentifying the same part throughout FIG. 1 and FIG. 2.

In FIG. 2, blood vessel sensor 31 is arranged in home biologicinformation sensor 13 into which a finger of a person requiringbiometrics authentication is inserted. Blood vessel sensor 31 includes aplurality of light sources of different wavelength band having differentlight absorption characteristic by the blood and blood vessel and lightreceiving element for receiving the source light influenced by the bloodand blood vessel. The output of blood vessel sensor 31 is sent to thefirst personal computer 5 and processed by image processing part 32 incontroller 12. The functions of controller 12 are actually carried outby software. In FIG. 2, however, a function is shown as a hardware blocksuch as “image processing part 31” for the purpose of explanation.

Of course, the functions are carried out actually by hardware blocks ora combination of hardware blocks and software.

Blood vessel pattern detecting part 33 detects blood vessel patterninherent to individual from an image processed by image processing part32. Comparison and authentication part 34 in controller 12 compares thedetected blood vessel pattern with registered pattern 35 stored inreference biologic information holder 14 to decide whether the detectedblood vessel pattern coincide with the registered blood vessel pattern.Thus, the authentication of the parson is made and controller 12 sendsthe unlock signal to door lock 11 if the identity is verified throughthe comparison.

The identification information form comparison and authentication part34 is also sent to individual health control database 15 foradministrating the gotten health control information under the name ofindividual.

Plethysmogram detecting part 36 in controller 12 detects plethysmogramof arteria on the basis of the image processed by image processing part32. The detected plethysmogram is analyzed by wave form analyzing part37 in controller 12. The first health determining part 38 compares theanalyzed waveform with reference wave form 39 stored in referencebiologic information holder 14 to diagnose the youth of blood vessel,which is in tern sent to individual health control database 15 forstorage along with identification information from comparison andauthentication part 34. The diagnosis on blood vessel youth by the firsthealth determining part 38 is indicated on television set 17 as has beenmentioned above.

Plethysmogram detected by plethysmogram detecting part 36 is alsoanalyzed by component analyzing part 40 in controller 12 to determinearterial blood component such as a ratio of oxygenated hemoglobin toreduced hemoglobin which is a measure of oxygen saturation. The secondhealth determining part 41 compares the analyzed component of arterialblood with reference component 42 stored in reference biologicinformation holder 14 to diagnose the arterial blood components, whichis in tern sent to individual health control database 15 for storagealong with identification information from comparison and authenticationpart 34. The diagnosis on arterial blood components by the second healthdetermining part 41 is also indicated on television set 17.

The diagnosis result of the first health determining part 38 and thesecond health determining part 41, which have been once stored inindividual health control database 15, are sent from controller 12 tomedical institution 9. As has been explained, the diagnosis resultgotten in real time by the first health determining part 38 and thesecond health determining part 41 are also sent to medical institution.

Plethysmogram detecting part 36 also informs comparison andauthentication part 34 of the detected plethysmogram. Comparison andauthentication part 34 will not make identification of a person forcontroller 12 to send the unlock signal to door lock 11 even if theblood vessel pattern detected by blood vessel pattern detecting part 33coincides with the registered blood vessel pattern 35 stored inreference biologic information holder 14 unless the plethysmogram isactually transmitted from plethysmogram detecting part 36. This is toprevent entrance door 10 from being unlocked by a fake finger providedwith a copied blood vessel pattern having no vital reaction.

FIG. 3 is a block diagram representing the detailed structure ofcondominium building entrance lock control system 8. The same numeral isused for identifying the same part throughout FIG. 1 and FIG. 3 withexplanation of the same numeral omitted unless additional comment isnecessary.

Commercial grade biologic information sensor 21 includes replaceableunits for allowing their exchange upon damaged. In other words, sensorunit 51 can be replaced by new one of the same or improved function withits outer shape and electric connector standardized for fitting into thecasing of commercial grade biologic information sensor 21 even if innerfunction of sensor unit 51 is improved. Protection unit 52 such as atransparent cover to which the inserted finger or outside dust maycontact is also replaceable by new one when tainted. Sensor unit 51 andprotection unit 52 are replaceable independently from each other formaking it possible to exchange only one of them in different occasionand by different reason.

Administration controller 53 of administration computer 19 is connectedwith sensor unit 51 for controlling its function and receiving thesensed signal from it. Further, administration controller 53 checkswhether or not sensor unit 51 is working correctly.

Administration controller 53 of administration computer 19 is connectedwith protection unit 52 for checking whether or not vandalized ortainted. Thus, protection unit 52 which is exposed to outsideenvironment is carefully monitored for prompt replacement thereof tokeep proper function of commercial grade biologic information sensor 21.

The detection of damage or taint on protection unit 52 is alternativelypossible by analyzing the output of sensor unit 53 without connectingadministration controller 53 directly to protection unit 52. In otherwords, damage or taint on protection unit 52 can be indirectly known bydetecting deterioration or the like of the output of sensor unit 51.

Further, administration controller 53 of administration computer 19initially checks fluctuation in the function of sensor unit 51 orprotection unit 52 when these are newly exchanged. In other words,administration controller 53 calibrates the performance of sensor unit51 or protection unit 52 by testing whether sensor unit 51 outputs anexpected level of signal under a given condition.

Admission refusal display 54 shows admission refusal indication if allthe personal computers inform administration computer 19 of the failurein coincidence of compared information or none of the personal computersinforms administration computer 19 of the coincidence. Auxiliaryauthentication interface 55 includes password input and IC cardinsertion slot for authenticating a person who cannot be identifiedthrough commercial grade biologic information sensor 21 but is reallyentitled to enter condominium building 1.

Health control failure display 56 shows that commercial grade biologicinformation sensor 21 cannot get sufficient health control informationbut has succeeded in authentication. By this display, a person whoexpects to check his or her health is informed of the failure in gettinghealth control information. It is left to the person's judgment whetherentering condominium building 1 without respect to the display or tryingagain to check health in more careful manner.

As is apparent from the above, health control failure display 56 servesas an indicator showing whether or not the authentication information isalso a sufficient biologic information for the purpose of healthcontrol. The indication can be made by sound or voice instead of visualdisplay.

The health control information gotten by condominium building entrancelock control system 8 does not relate to the entrance lock controlitself, but absolutely to individual inhabitant in the apartment.Therefore, the necessity of indication at health control failure display56 is to be judged exclusively by the first personal computer 5 in thefirst apartment 2 or the like, mere result being transmitted tocondominium building entrance lock control system 8 for indication athealth control failure display 56.

However, condominium building entrance lock control system 8 can judgewhether or not the gotten biologic information is sufficient also forthe purpose of health control if magnitude level of the output ofcommercial grade biologic information sensor 21 is measured. Thus,administration computer 19 may control whether or not to make indicationat health control failure display 56. It may possible to finally controlthe indication of health control failure display 56 on both thejudgments of administration computer 19 and the first personal computer5.

Outside circumference sensor 57 is for sensing climate condition such astemperature, humidity and wind velocity. Administration controller 53combines the climate condition information with the biologic informationto send them to the first personal computer 5 as well as date and timeof getting those information.

Presence sensor 58 detects an approach of a person within apredetermined area for automatically triggering commercial gradebiologic information sensor 21 to start its function.

The structure of commercial grade biologic information sensor 21including sensor unit 51 and protection unit of replaceable nature inFIG. 3 is also applicable to home biologic information sensor 13.Further, admission refusal display 54, auxiliary authenticationinterface 55, health control failure display 56, outside circumferencesensor 57 and presence sensor 58 in FIG. 3 can also be arranged aroundentrance door 10 of the first apartment 2 or the like.

FIG. 4 is a flow chart of the basic function of controller 12 of thefirst personal computer 5 located in the first apartment 2. The basicfunction is suitably repeated in accordance with the operation system ofthe first personal computer 5.

When the flow starts, it is checked whether or not commercial gradebiologic information sensor 21 is replaced by a new one in step S1. Ifthe replacement has been done, new driver software for the newcommercial grade biologic information sensor 21 is automaticallydownloaded from administration computer 19 and installed into the firstpersonal computer in step S2 so as to handle information form the newtype of commercial grade biologic information sensor 21, and the flowadvances to step S3. On the other hand, the flow directly advances formstep S1 to step S3 if there is no replacement done.

In step S3, it is checked whether or not the software in administrationcomputer 19 has been upgraded. If the software has been upgraded, thenew software is automatically downloaded from administration computer 19and installed into the first personal computer 5 in step S4, and theflow advances to step S5. On the other hand, the flow directly advancesform step S3 to step S5 if there is no software upgraded.

In step S5, it is checked whether or not new reference information hasbeen registered at reference biologic information register 23 of medicalinstitute 9. If new reference has been registered, the new reference isautomatically downloaded from medical institution 9 and stored intoreference health information holder 16 in step S6, and the flow advancesto step S7. On the other hand, the flow directly advances form step S5to step S7 if there is no new reference registered.

In step S7, it is checked whether or not biologic information comparingsoftware 24 in medical institution 9 has been upgraded. If the softwarehas been upgraded, the new software relating to the upgrade isautomatically downloaded from host computer 22 in medical institution 9and installed into the first personal computer in step S8, and the flowadvances to step S9. On the other hand, the flow directly advances formstep S7 to step S9 if there is no software upgraded.

In step S7, the software in the first personal computer 5 is comparedwith current biologic information comparing software 24 to decidewhether or not the biologic information comparing software 24 isupgraded. In other words, the decision of “upgraded” does not relate towhen the upgrade of biologic information comparing software 24 wasactually done, but relates to what software is in the first personalcomputer 5 when the comparison in step S7 is done. So, if the firstapartment 2 has just joined the home health control system with nosoftware relating the system existing in the first personal computer 5yet, step S7 decides that “upgrade has been done” to automaticallyinstall the current biologic information comparing software 24 into thefirst personal computer 5 in step S8 regardless of the actual upgradetime at medical institution 9.

In step S9, it is checked whether or not home biologic informationsensor 13 is replaced to a new one. If the replacement has been done,necessary procedure is taken in step S10 to install new driver softwarefor the new sensor, and the flow advances to step S11. On the otherhand, the flow directly advances form step S9 to step S11 if there is noreplacement done.

In step S11, a procedure of registering new reference information intoreference biologic information holder 14 of the first personal computer5 is done. This procedure is necessitated upon moving of a new familyinto condominium building 1, or addition of a new member to a family, orreplacement into an upgraded home biologic information sensor 13 orcommercial grade biologic information sensor 21 requiring a newreference biologic information. The procedure of registering newreference information for home biologic information sensor 13 differsfrom that for commercial grade biologic information sensor 21. Theseprocedures in detail will be explained later.

Next, the performance of the sensors is checked in step S12. This checkis necessary not only for initially confirming the performance of thenewly replaced sensor relating to step S1 or step S9, but also forperiodically inspecting the existing sensors to promptly find out theirdamage or deterioration. This procedure in detail will be explainedlater.

Step S12 is followed by step S13 in which a procedure of starting thesystem, the detail of which will be explained later. And then flowadvances from step 13 to step 14 to make the first personal computer 5into a condition of waiting the authentication trigger. Under such aauthentication trigger waiting condition, the first personal computer 5can automatically start the authentication when a person comes in frontof entrance door 10 is detected. The first personal computer 5 can alsostart the authentication when it is informed by administration computer19 that presence sensor 58 detects a person in front of the entrance ofcondominium building 1.

When the authentication is automatically triggered under the waitingcondition, the first personal computer 5 distinguishes whether thetrigger is caused by the authentication request by someone at homebiologic information sensor 13 or by the information from administrationcomputer 19, to thereby enter into one of the two different flowscorresponding to the two cases, respectively. The two different flowsare each explained later in detail. If the first personal computer 5 isin use for another purpose, an indication of the fact that theauthentication is triggered is superimposed on the monitor of the firstpersonal computer 5.

FIG. 5 is a flow chart showing the detail of step 12 in FIG. 4 thatrelates to the procedure of starting the system by the controller 12 ofthe first personal computer 5.

When the system start procedure is initiated, it is checked in step S21whether any reference information is registered in reference biologicinformation holder 14. If there is some reference is registered, theflow advances to step S22 to make the system into a condition of waitingan authentication request at entrance door 10 with respect to eachperson relating to the registered reference.

Next, it is checked in step S23 whether or not the first apartment 2 hasjoined condominium building entrance lock control system 8. If the firstapartment 2 has joined the system, the flow advances to step S24 to makethe system into a condition of waiting an authentication requestthorough condominium building entrance lock control system 8 withrespect to each person relating to the registered reference, and theflow advances to step S25. If the first apartment 2 is determined instep S23 not to join the system, the flow advances directly to step S25.In this case, the unlocking on the basis of biometrics is limited toentrance door of the first apartment 2. In other words, the inhabitantof the first apartment 2 is not entitled to go through the entrance ofcondominium building 1 on the biometrics.

In step S25, it is checked whether or not the first apartment 2 hasjoined the home health control system administrated by medicalinstitution 9. If the first apartment 2 has joined the system, the flowadvances to step S26 in which the first personal computer 5 comes tostandby state of accumulating health control information into individualhealth control database 15 with respect to every person corresponding toreference information registered in reference biologic informationholder 14.

Next, in step S27, the first personal computer 5 also comes to standbystate of displaying on television set 17 the moment-to-moment change inthe output of the biologic information sensors stored in individualhealth control database 15. Such a display is possible without thereference health control information.

Next step S28 checks whether or not the reference health controlinformation registered by reference biologic information register 23 ofmedical institution 9 has been stored in reference health informationholder 16. If the health control information has been stored inreference health information holder 16, the flow advances to step S29 inwhich the first personal computer 5 comes to standby state of comparinghealth control information coming from the sensors or stored inindividual health control database 15 with the reference information inreference health information holder 16 with respect to every personcorresponding to reference information registered in reference biologicinformation holder 14.

Next, in step S30, the first personal computer 5 also comes to standbystate of displaying on television set 17 the result of the comparison,and the flow goes to step S31.

In step S21, if there is no reference information registered inreference biologic information holder 14, the flow directly goes to stepS31 since the function of authentication for unlocking and healthcontrol cannot be expected at all.

Further, in step S25, if the first apartment has not joined the homehealth control system administrated by medical institution 9, the flowdirectly goes to step S31 since the function of health control cannot beexpected.

In step S28, if the reference health control information registered byreference biologic information register 23 of medical institution 9 hasnot been stored in reference health information holder 16, the flowdirectly goes to step S31 since the function of steps 29 and 30 cannotbe expected.

From step S31, the authentication of the user of the first personalcomputer 5 starts. In step S31, it is checked whether or not thereference information for authenticating the personal computer user isregistered in reference biologic information holder 14. If the referenceinformation is registered, the flow advances to step S32 in which thefirst personal computer 5 comes to standby state of waitingauthentication request to access the first personal computer 5 withrespect to every person corresponding to reference informationregistered in reference biologic information holder 14, and the flowadvances to step S33. On the other hand, if there is no referenceregistered in reference biologic information holder 14, the procedure ofstarting the system is instantly terminated to go to step S14 of FIG. 4since no more step is necessary.

Following step S32, it is checked in step S33 whether or not the userauthentication function of the first personal computer 5 has joined thehome health control system administrated by medical institution 9. Ifthe use authentication function of the first personal computer 5 hasjoined the home health control system, the flow advances to step S34 inwhich the first personal computer 5 comes to standby state of storinghealth control information into individual health control database 15and comparing the same with the reference information stored inreference biologic information holder 14 with respect to every personcorresponding to reference information registered in reference biologicinformation holder 14, and the procedure of starting the system isterminated. On the other hand, if the user authentication function ofthe first personal computer 5 has not joined the home health controlsystem, the procedure of starting the system is instantly terminated.

In FIG. 5, the preparation of the standby state of both storing healthcontrol information and comparing the same with the reference is shownas if such a function is carried out by single step of step S34. Indetail, however, step S34 includes a plurality of sub-steps similar tostep 26 to step 30. In other words, in the initial stage of step S34,the first personal computer 5 comes to a standby state of storing healthcontrol information into individual health control database 15 anddisplaying the moment-to-moment change in the health controlinformation, which is similar to the function carried in steps S26 andstep S27. And in the succeeding stage of step S34, after confirming thatthe reference health control information has been stored in referencehealth information holder 16, the first personal computer 5 comes tostandby state of comparing health control information with the referenceinformation in reference health information holder 16 and displaying theresult, which is similar to the function carried out in steps S28 andstep S30.

FIG. 6 is a flow chart of the function carried out by controller 12 ofthe first personal computer 5 located in the first apartment 2 with theauthentication system triggered by a person coming to stand in front ofentrance door 10.

If the system is triggered, it is checked in step S41 whether or not apredetermined time has passed after the person comes to stand in frontof entrance door 10. If the time has not passed yet, the flow advancesto step S42 in which it is checked whether or not a finger is insertedinto home biologic information sensor 13. If no finger is inserted, theflow goes back to step S41, and steps S41 and S42 are repeated waitingfor the insertion of a finger for the predetermined time.

If the insertion of a finger is detected in step S42, the flow goes tostep S43 in which the sensed biologic information from the finger iscompared with the reference biologic information stored in referencebiologic information holder 14 to determine whether or not the bothcoincide with each other. If the sensed information coincides with thereference information, the flow advances to step S44 in which it ischecked whether home biologic information sensor 13 succeeds in gettingsufficient information for health control. A case of failure in step S44means that the biologic information gotten by home biologic informationsensor 13 is sufficient for the purpose of authentication of unlock, butis insufficient for the purpose of health control. Thus, the biologicinformation gotten by home biologic information sensor 13 has the firstlevel of accuracy required by authentication and the second level ofaccuracy required by health control, the second accuracy level beinggenerally higher. Further, it takes more time to take the secondaccuracy level of biologic information. So, if the time of inserting thefinger is too short, it may be judged in step S44 that home biologicinformation sensor 13 fails in getting sufficient information for healthcontrol.

If it is judged that in step S44 that home biologic information sensor13 succeeds in getting sufficient information for health control, theflow advances to step S45 in which the sensed information is stored intoindividual health control database 15. The information stored inindividual health control database 15 is also sent to host computer 22in real time for the storage in central health control database 27. Thismeans that the information in individual health control database 15 isbacked up by central health control database 27, which make it easy formoving out of condominium building 1 without losing individual healthcontrol database.

Next, in step S46, it is checked whether or not a reference exists inreference health information holder 16. If there is any referenceinformation, the flow advances to step S47 in which the sensedinformation is compared with the reference in reference healthinformation holder 16. And, the flow goes to step S48 to judge whetherthe result of comparison show any abnormality of health controlinformation. If some abnormality detected, the flow advances to step S49to prepare for display on television set 17 so that an indication of theabnormality caution is to be automatically made when its power switch isturned on, and the flow goes to step S50. If there is no abnormalityjudged, the flow directly goes to step S50. Upon the indication ofabnormality, a display with identification of a person relating to suchan abnormality is possible on the basis of the result of function instep S43.

With respect to the display on television set 17, it is possible toindicate in step S49 some new biologic information inviting attention ofthe person originating the biologic information even if such newinformation does not mean any abnormality. In this case, step S48 ismodified to be capable of further detecting the existence of such newbiologic information.

Further, in step S49 may be modified to automatically turn on televisionset 17 to instantly make the indication of abnormality if theabnormality is of high emergency.

For respecting the privacy, it is possible to previously set the firstpersonal computer 5 not to prepare the indication of abnormality ontelevision set 17 in step S49 for a specific person who does not wantthe indication to be made automatically under a possibility of presenceof another person even in the same family.

In step S50, the comparison result is gotten in step S47 is stored inindividual health control database 15. The information stored inindividual health control database 15 in step S50 is also sent to hostcomputer 22 in real time for the storage in central health controldatabase 27. The abnormality judged in step S48 is also sent to hostcomputer 22 in real time for the storage in central health controldatabase 27.

By way of the above steps, the flow comes to step S51 to inform doorlock 11 of the unlock direction. In response to the direction, door lock11 unlocks entrance door 10. After unlocking door lock 11, step S52checks again whether or not the predetermined time has passed after theperson comes in front of entrance door 10. The meaning of step S52 isexplained later.

If it is detected in step S46 that there is no reference information inreference health information holder 16, the flow directly goes to stepS51 to instantly inform door lock 11 of the unlock direction since thereis no necessity of carrying out steps S47 to S50.

On the other hand, if it is determined that home biologic informationsensor 13 fails in getting sufficient information for health controlinformation, the fact of failure is displayed in step S53, the reason offailure being also displayed in step S54 prior to getting to step S51.Thus, even if the health control information is failed to be gotten, theunlocking of door lock 11 itself is made.

A person who is going to enter entrance door 10 and perceives thedisplay of the failure and its reason may try to insert his or herfinger again into home biologic information sensor 13. Step S52 isprovided for such a case. In other words, if the predetermined time hasnot passed yet after the person comes in front of entrance door 10, theflow returns from step S52 to step S41, which makes it possible for theperson to again insert his or her finger. On the other hand, if it isdetermined in step S52 that the predetermined time has passed, the flowof FIG. 6 go to the end. If the person still wants to try again gettingthe health control information after the predetermined time has passed,the person can try it by means of once coming off the entrance door 10and again approaching it so as to trigger the flow of FIG. 6.

If the person is in hurry to enter entrance door 10, he or she can enterinto the first apartment 5 with noting the display of the failure ingetting health control information in step 53 and step 54. In this case,however, the person learns by heart the reason of failure displayed, andwill insert the finger with care not to repeat the same failure nexttime.

In step S41, if the predetermined time has passed after the person comesto stand in front of entrance door 10 without inserting a finger, theflow advances to step S55, in which admission refusal indication isdisplayed. Further, the indication of the reason of refusal is displayedin step S56, the reason being the non-insertion of a finger in thiscase.

Next, in step S57, auxiliary conventional authentication system such aspassword system or IC card system is made available to check whether ornot such an auxiliary conventional authentication is successful. It theauxiliary conventional authentication is successful, the flow advancesto step S51 to unlock the door lock 11. It should be noted that the caseof unlocking by way of step S57 is recorded so as to be distinguishablefrom the case of unlocking by way of step S50 or step S54. This isbecause that the authentication by means of biometrics system is thebase of the system according to this invention, the auxiliaryconventional authentication system being mere a backup with lowersecurity. So, the distinguishable record of unlocking by means of theauxiliary conventional system serves as a warning that the system isunable to function normally.

If the auxiliary conventional authentication is not made orunsuccessful, the flow finally goes to the end by way of step S2,entrance door 11 being not unlocked.

If the sensed information does not coincide with the referenceinformation or is insufficient to be compared with the referenceinformation in step S43, the flow advances to step S55 to display theadmission refusal indication. Further, the indication of the reason ofrefusal is displayed in step S56, the reason being the discrepancy orinsufficiency of the sensed information in this case.

Next, in step S57, the auxiliary conventional authentication system suchas password system or IC card system is made available to unlock thedoor lock in step S51 if the auxiliary conventional authentication issuccessful in step S57. If the auxiliary conventional authentication isnot made or unsuccessful, the flow finally goes to the end by way ofstep S2.

If the predetermined time has not passed yet in step S52 coming by wayof step S57, the flow retunes to step S42 by way of step S41. So, it ispossible to go to step S44 by way of step S43 to finally get to step S51for unlocking entrance door 10 if the person more carefully inserts thefinger again with the indication made in step S56 taken intoconsideration.

It should be noted that step 43 is located before step S44 not to allowgetting to the health control flow unless the authentication forunlocking purpose is successful. The first reason is that a person whocannot be authenticated has no meaning of health control at all.

The second reason, which is more important, is that the health controlinformation is prevented from being gotten from a person who inserts thefinger improperly even if the person is entitled to enter the entrancedoor 10. In other words, the success in authentication is a proof of theproper insertion of the finger at least of the authentication level. Bythis arrangement, wrong health control information gotten with thefinger improperly inserted is prevented from being gotten.

In other words, reliability of the health control information is kept byexcluding health control information of a person who cannot beauthenticated even if biologic information gotten by such a person is ofa sufficient level for health control.

FIG. 7 is a flow chart of the function carried out by controller 12 ofthe first personal computer 5 located in the first apartment 2 with theauthentication system triggered by administration computer 19 thatinform the first personal computer 5 of a person coming to stand infront of the entrance of condominium building 1. Since the function ofFIG. 7 is similar to that of FIG. 6, the explanation is omitted with thedifference only commented.

In place of the first personal computer 5 which checks the insertion ofa finger in S42 in FIG. 6, administration computer 19 makes the check offinger insertion. Accordingly, in step 62 in FIG. 7, it is checkedwhether or not administration computer 19 informs the first personalcomputer 5 of the finger biologic information gotten by commercial gradebiologic information sensor 21 located at condominium building entrancelock control system 8.

Step 64 is typically added in FIG. 7 in which “coming home” signal isgenerated when the received finger biologic information coincides withthe reference biologic information in step S63. By means of such a“coming home” signal, a wife in the first apartment 2 for example canknow in advance the coming home of her husband at the stage that he hasjust gotten to the entrance of the condominium building 1. Or, in thecase that the coming home person lives alone, the “coming home” signalcan be used to automatically turn on the illumination and airconditioner of the first apartment 2.

FIG. 6 includes steps S53 to S56 relating to various indication display.In the case of FIG. 7, however, the corresponding indication isdisplayed by administration computer 19 which controls admission refusaldisplay 54 and health control failure display 56. Therefore, incorresponding steps S74 to S77 of FIG. 7, the first personal computersends command signal to have administration computer 19 carry out theindication display.

In FIG. 6, step 56 is followed by step S57 for the auxiliaryconventional authentication carried out by the first personal computer5. In the case of FIG. 7, on the contrary, the corresponding auxiliaryconventional authentication in condominium building entrance lockcontrol system 8 is carried out only by administration computer 19.Therefore, step S77 instantly leads to step S73.

Further, FIG. 6 includes steps S51 relating to the unlocking of theentrance door 10. In the case of FIG. 7, however, the correspondingunlocking of the entrance of condominium building 1 is carried out byadministration computer 19. Therefore, in corresponding step S72 of FIG.7, the first personal computer sends an unlock command signal to haveadministration computer 19 carry out the unlock function.

The unlock command signal sent in step S72 is a very important signalnot relating to a local apartment only, but relating to entirecondominium building 1. So, the command signal is carefully sent in stepS72 in accordance with an administration command from administrationcomputer 19 received along with the finger biologic information in stepS62. In other words, the unlock command signal is encrypted inaccordance with the administration command. Further, the timing to sendthe unlock command is limited within a very short period directed byadministration command from administration computer 19. The detail ofthe manner of sending the unlock command will be explained later.

Functions of the steps in FIG. 7 other than the above are similar to thecorresponding functions in steps in FIG. 6 and the explanation thereforeis omitted.

FIG. 8 is a flow chart showing the details of step 47 in FIG. 6 and step68 in FIG. 7 relating to the comparison function carried out bycontroller 12 of the first personal computer 5.

If the comparison flow starts, it is checked in step S81 whether or notindividual health control database 15 includes any information stored inthe past. If there is some information storage, the flow advances tostep S82 in which it is checked in step S82 whether or not apredetermined time has passed since the information was stored. This isbecause a too new past information stored within the predetermined timeis meaningless to be analyzed.

If there is some information stored in individual health controldatabase 15 with the predetermined time having passed since its storagedate, the flow advances to step 83 in which the past information is readout from individual health control database 15. The read out pastinformation is processed in step S84 for comparison. According to thepast information comparison process in step S84, not only the pastinformation read out from individual health control database 15, butalso current information newly gotten by home biologic informationsensor 13 or commercial grade biologic information sensor 21 isprocessed. The process in step S84 includes analysis of themoment-to-moment change and season change or the like, the details beingexplained later. The process in step S84 is followed by step S85.

In step S81, on the other hand, if individual health control database 15includes no information stored in the past, the flow directly advancesto step S85. Also in step S82, if all the past information storage aretoo new not exceeding the predetermined time, the flow directly advancesto step S85. This is because steps S83 and S84 are not necessary in boththe cases.

In step S85, the current information newly gotten by home biologicinformation sensor 13 or commercial grade biologic information sensor 21is accumulated in individual health control database 15. Step S85 isfollowed by step S86 in which the current information is simply comparedwith the reference information in reference health information holder 16to go to step S87. In steps beginning form step S87, it is checkedwhether or not further high grade comparison process is possible tocarry out such a high grade comparison process if possible.

In step S87, it is checked whether or not the newly gotten biologicinformation relates to an item typical of commercial grade biologicinformation sensor 21. A negative answer to the question in step S87means that the newly gotten biologic information relates to an itemcommon to both home biologic information sensor 13 and commercial gradebiologic information sensor 21. In this case, accordingly, the flowadvances to step S88 to check whether or not any same item of biologicinformation is gotten by both home biologic information sensor 13 andcommercial grade biologic information sensor 21 within a predeterminedshort period.

If such the same item of biologic information exists, it is normallyassumed that a coming home inhabitant of the first apartment 2 forexample makes the first authentication with commercial grade biologicinformation sensor 21 at the entrance of condominium building 1 andsuccessively makes the second authentication with home biologicinformation sensor 13 at entrance door 10 of the first apartment 2.

If same item of biologic information gotten by both home biologicinformation sensor 13 and commercial grade biologic information sensor21 within a predetermined short period exists, the flow advances to stepS89 to check whether or not the condition of getting the same item ofbiologic information is the same. If the information getting conditionis the same, the flow advances to step S90 to conduct a cross checkbetween both the information from home biologic information sensor 13and commercial grade biologic information sensor 21. It is assumed thatthe two biologic information of the same item gotten within the shortperiod under the same condition are nearly equal to each other. So, ifthe two differ from each other over a limit, one of the sensors maypossibly be out of order. Thus, if the two biologic information of thesame item gotten within the short period under the same condition arenearly equal to each other in step S90, which means that both thebiologic information are reliable, the flow advances to step S91 toaverage the two biologic information for improving the accuracy ofinformation. And then, flow goes to the end.

On the other hand, if the two biologic information of the same itemgotten within the short period under the same condition differ from eachother over a limit in step S90, the flow advances to step S92 toidentify one of the sensors which is out of order in accordance with acomparison between the newly gotten biologic information and the pastbiologic information stored in individual health control data base 15, acaution being made that the identified sensor is in trouble or out oforder. Further, the information gotten from the identified sensor isdismissed as being unreliable in step S93.

Thus, if the condition, under which the same item of biologicinformation is gotten, is the same in step S89 with respect to homebiologic information sensor 13 and for commercial grade biologicinformation sensor 21, the same item of biologic information is analyzedtwice for improving the reliability of the biologic information.

On the contrary, if the information getting condition is not the same instep S89 with respect to home biologic information sensor 13 and forcommercial grade biologic information sensor 21, a comparison analysisdepending on the change in the information getting condition ispossible. The difference in information getting condition means thedifference in exercise stress on the same person between the cases ofauthentication by commercial grade biologic information sensor 21 and byhome biologic information sensor 13. Further, the change in circumstancesuch as temperature between the outside where commercial grade biologicinformation sensor 21 is located and the inside where home biologicinformation sensor 13 is located is another example of the change ininformation getting condition. These difference in information gettingcondition may influence on health control information, which make itpossible to analyze the health control information depending on theinformation getting condition.

If such a difference in information getting condition is detected instep S89, the flow advances to step S94 in which the comparison betweenthe gotten information and the reference information is made with thecorrelation to the information getting condition taken intoconsideration. Examples of the information getting condition to beconsidered in analyzing the correlation are the pulsation which reflectsthe exercise stress and temperature, humidity and wind velocity, or thelike.

In step S87, if it is checked that the newly gotten biologic informationrelates to an item typical of commercial grade biologic informationsensor 21, home biologic information sensor 13 never senses the sameitem of biologic information. Therefore, the flow is instantly endedwith the current information having been simply compared with thereference information in reference health information holder 16 in step86.

Further in step 88, if any same item of biologic information is notgotten by both home biologic information sensor 13 and commercial gradebiologic information sensor 21 within the predetermined short period,the flow is instantly ended since the steps beginning from step S89 arenot meaningful any more in such a case.

It should be noted that the flow chart in FIG. 8 makes it possible forstep 88 to advance to step S89 in such a case caused by some specialreason that the same item of biologic information is successively gottenwithin the predetermined short period by only one of home biologicinformation sensor 13 and commercial grade biologic information sensor21.

FIG. 9 is a flow chart showing the basic function of administrationcontroller 53 of administration computer 19 located at condominiumbuilding entrance lock control system 8. The basic function is suitablyrepeated in accordance with the operation system of administrationcomputer 19.

When the flow starts, it is checked whether or not sensor unit 51 ofcommercial grade biologic information sensor 21 is replaced to a new onein step S101. If the replacement has been done, new software for the newsensor unit 51 is installed into administration computer 19 in stepS102. If the new sensor unit 51 is provided by medical institution 9,administration controller 53 automatically downloads the new softwarefrom host computer to automatically install the downloaded software. Theflow goes to step S103 after the install of the new software. On theother hand, if sensor unit 51 is not replaced, the flow goes from stepS101 to step 103 directly.

In step S103, it is checked whether or not biologic informationcomparing software 24 in medical institution 9 has been upgraded. If thesoftware has been upgraded, the new software is automatically downloadedfrom host computer 22 to be installed into the administration computer19 in step S104, and the flow advances to step S105. On the other hand,the flow directly advances form step S103 to step S105 if there is nobiologic information comparing software 24 upgraded.

In step S103, medical institution 9 can also inform administrationcomputer 19 of other services that medical institution 9 can provide aswell as the upgraded biologic information comparing software 24. Inother words, step S103 which has to be carried out without fail for thepurpose of maintenance of health control system is an importantopportunity for medical institution 9 to advertise other business. Instep S103, for example, medical institution 9 can inform its individualclient of a reminder of next consultation day or announcement of routinehealth checkups or season pollen information through administrationcomputer 19.

If medical institution 9 sends in step S103 the above mentionedinformation having no direct relation to the health control system,administration computer 19 stores such information in step 104 totransmit it to the first personal computer 5 or the like so that theinformation will be displayed on television set 17 when turned on.

The function in steps S103 and S104 explained above can be carried outby the first personal computer in Steps S7 and S8 so as to directlyreceive from medical institution 9 the information having no directrelation to the health control system.

In step S105 it is checked whether or not protection unit 52 which isexposed to outside environment is vandalized or tainted. If it isdetermined that sensor unit 51 is out of order because of vandalized ortainted protection unit 52, the flow goes to step S106 to make a cautionto replace protection unit 52 and advances to step S107. On the otherhand, if protection unit 52 is not vandalized or tainted checked, theflow directly goes from step S105 to S107.

In step S107, it is checked whether or not any change in the membershipof condominium building entrance lock control system 8 has been caused.The change means that an apartment gets in or out of condominiumbuilding entrance lock control system 8. If there is some change in themembership, the flow advances to step S108 to put the change intocondominium building entrance lock control system 8 for updating thesame.

By means of these steps, an inhabitant newly move into condominiumbuilding 1 is becomes to be entitled to enter the entrance ofcondominium building 1. In other words, administration computer 19 canadministrate all the apartments currently joining condominium buildingentrance lock control system 8 for receiving the necessary unlockcommand signal from one of the apartments without fail. After theprocess carried out in step S108, the flow advances to step S109. Ifthere is no change in the membership, on the other hand, the flowdirectly goes from step S10 to step S109.

In step S109, it is checked whether or not new reference information isrequired to be registered at condominium building entrance lock controlsystem 8. If new reference registration is required, the flow advancesto step S110 to make necessary step to register the new reference, andfurther advances to step S111. The details of step S110 will beexplained later. On the other hand, the flow directly advances form stepS109 to step S111 if there is no new reference registration required.

In step S111, the performance of the sensor is checked. This check isbasically similar to the check conducted in step S12 in FIG. 4.Administration computer 19 is, however, in charge of checking commercialgrade biologic information sensor 21 with respect to its initialfunction upon replacement and a damage or deterioration causedthereafter. The details of step S111 will be explained later.

And then flow advances from step 111 to step 112 to make theadministration computer 19 into a condition of waiting theauthentication trigger. Under such a authentication trigger waitingcondition, administration computer 19 can automatically start theauthentication when presence sensor 58 detects a person comes in frontof the entrance of condominium building 1.

FIG. 10 is a flow chart of the function carried out by administrationcontroller 53 of administration computer 19 with the authenticationsystem triggered by a person coming to stand in front of the entrance ofcondominium building 1.

If the system is triggered, it is checked in step S115 whether or not apredetermined time has passed after the person comes to stand in frontof the entrance of condominium building 1. If the time has not passedyet, the flow advances to step S116 in which it is checked whether ornot a finger is inserted into commercial grade biologic informationsensor 21. If no finger is inserted, the flow goes back to step S115,and steps S115 and S116 are repeated waiting for the insertion of afinger for the predetermined time.

If the insertion of a finger is detected in step S116, the flow goes tostep S117 in which the sensed biologic information from the finger issent to all the apartments joining condominium building entrance lockcontrol system 8. And, in step S118 it is checked whether or not anunlock command signal is received from any of the apartments whichdetects that the sent biologic information coincides with a referencebiologic information for authentication. The unlock command signal isencrypted for preventing it from being forged or for avoiding confusionwith an error command. Further, the timing for an apartment to send theunlock command is limited within a short period directed by anadministration command from administration computer 19. The encryptionkey and the administration command are changed every time on randomnumber generator and sent to all the apartments along with the sensedbiologic information in step 117. If it is determined in step 118 thatan unlock command signal is received from one of the apartments, theflow advances to step S119.

In step S119, it is checked whether the receipt of the unlock commandsignal in step 118 was within the very short time period determined bythe administration command signal sent in step S117. The unlock commandsignal is very important since it causes the unlocking of the entranceof condominium building 1. So, not only it is checked whether the unlockcommand signal is received in step S118, but also it is checked whethersuch unlock command signal was received within the very short timeperiod in step S119. Thus, condominium building entrance lock controlsystem 8 prevents the entrance door from being unlocked by a forged orerror command signal. As has been explained, the very short time periodis unique for each of the apartments and is changed on random numbergenerator every time it is sent in step 117. So, only a personalcomputer in the apartment that has been informed of the very short timeperiod can send the unlock command signal to administration computer 19.An unlock command signal received off the very short time period is,accordingly, deemed as a forged or error command signal.

If it is checked that the receipt of the unlock command signal waswithin the very short time period in step 119, the flow advances to stepS120.

In step S120, it is checked whether or not administration computer 19 isinformed of a failure of getting health control information by any ofthe apartments. The receipt of such a failure information in step S120means that an apartment judged that the sensed information sent in stepS117 is sufficient for the purpose of unlock authentication, butinsufficient for the purpose of health control.

If no failure information is received from any apartment in step 120,the flow advances to step S121 to direct entrance lock 20 to unlock theentrance door. Entrance lock 20 unlocks the entrance door in response tothe direction.

In receiving information in steps S118 to S120, administration computer19 is blocked from identifying a specific apartment that sends theunlock command signal and failure information for the purpose of privacyprotection.

After the direction to entrance lock 20, the flow advances to step S122to delete the biologic information which has been gotten in step S111.This is to secure privacy protection. And, the flow advances to step 123to check again whether or not a predetermined time has passed after theperson comes to stand in front of the entrance of condominium building1. If the time has passed, the flow terminates the unlock process.

On the other hand, if it is checked that administration computer 19 isinformed of a failure of getting health control information by any ofthe apartments, the flow advances to step S124 to display the fact offailure, the reason of failure being also displayed in step S125 priorto getting to step S121. Thus, also in condominium building entrancelock control system 8, the direction is made toward entrance lock 20 tounlock the entrance door even if it is failed to get health controlinformation.

If it is checked in step S115 that the predetermined time has passedafter the person comes to stand in front of the entrance of condominiumbuilding 1, the flow advances to step 126 to display admission refusalindication. Further, the indication of the reason of refusal isdisplayed in step S127, the reason being the non-insertion of a fingerin this case.

Next, in step S128, auxiliary conventional authentication system such aspassword system or IC card system is made available to check whether ornot such an auxiliary conventional authentication is successful. It theauxiliary conventional authentication is successful, the flow advancesto step S121 to direct entrance lock 20 to open the entrance ofcondominium building 1. In analogy with the case of step S57 in FIG. 6,the case of unlocking by way of step S128 is recorded so as to bedistinguishable from the case of unlocking by way of step S120 or stepS125. It should be noted, however, that the higher security is requiredin the case of step S128 since the entrance of condominium building 1 isthe public passage. Therefore, ID of the person who tried to go throughthe entrance of condominium building 1 by means of the auxiliaryconventional authentication in step S128 is also recorded.

If the auxiliary conventional authentication is not made orunsuccessful, the flow finally goes to the end by way of steps S122 andS123, entrance lock 20 being not unlocked. In this case, step S122 hasbasically no function since there is no biologic information gotten.However, step S128 is followed by step S122 for the reason below.

If no unlock command signal is received from any of the apartments oradmission refusal command is received from all of the apartments in stepS118 with biologic information having gotten in step S116, the flowadvances to step S126 to display admission refusal indication. Further,the indication of the reason of refusal is displayed in step S127.

If it is determined that the received unlock command signal is notwithin the very short period in step S119, the flow advances to stepS126 to display admission refusal indication and in turn to step S127 todisplay the reason of refusal.

If administration computer 19 cannot know by itself the reason ofrefusal, the reason information sent in step S77 in FIG. 7 is utilized.However, administration computer 19 is blocked from identifying aspecific apartment that sends the reason of refusal for the purpose ofprivacy protection.

Next, in step S128, auxiliary conventional authentication system such aspassword system or IC card system is made available to check whether ornot such an auxiliary conventional authentication is successful. It theauxiliary conventional authentication is successful, the flow advancesto step S121 to direct entrance lock 20 to open the entrance ofcondominium building 1. If the auxiliary conventional authentication isnot made or unsuccessful, the flow goes to steps S122 to delete thebiologic information. Thus, even in a case of failure of authentication,the biologic information is deleted for the purpose of privacyprotection.

Next, the flow goes to step S123. If the time has not passed yet, theflow returns to step S116 by way of step S115, which makes it possiblefor the person to again insert his or her finger to have the flow go tostep S117. This time, the person may more carefully insert the fingerwith the reason indication in step S127 taken into mind.

FIG. 11 is a flow chart showing the basic function of host controller 26of host computer 22 located at medical institution 9. The basic functionis suitably repeated in accordance with the operation system of hostcomputer 22. When the flow starts, it is checked in step 131 whether ornot there is any change in commercial grade biologic information sensor21, such as a new registration, deletion of registration, or upgradingof sensor 21. The upgrading of sensor 21 includes an addition of somenew function to sensor 21 with the registration thereof unchanged. Ifthere is any change in sensor 21, the flow advances to step S132 toupdated host computer 22 for reflecting the change in data or software,and the flow goes to step S133. Thus, host computer 22 can correspond toany change in commercial grade biologic information sensor 21 of anyclient. On the other hand, the flow directly goes to step 133 if thereis no change in commercial grade biologic information sensor 21.

In step S133, it is checked whether or not there is any change in homebiologic information sensor 13, such as a new registration, deletion ofregistration or upgrading of sensor 13. The upgrading of sensor 13includes an addition of some new function to sensor 13 with theregistration thereof unchanged. If there is any change in sensor 13, theflow advances to step S134 to carry out “moving process”, and the flowgoes to step S135.

In the case of home biologic information sensor 13, new registration,deletion of registration or updating of the sensor relates not only to asimple upgrading of it, but also to moving of a family into or out ofthe condominium building in many case, which necessitates the “movingprocess” including arrangement or disposal of data in personal computerin the apartment. The detail of “moving process” will be explainedlater. On the other hand, if there is no change in home biologicinformation sensor 13, the flow directly goes to step 135

In step S135, it is checked whether or not there is any change inregistration of patient, such as addition, deletion or alteration. Ifthere is any change in the patient registration, the flow advances tostep S136 to change data of host computer 22 to reflect the addition,deletion or alteration of the patient.

The addition, deletion or alteration of patient is caused in many casesby a patient who changes medical institution 9 into new one closer tothe new residence or with other convenience. So, in step 137, necessaryaction is taken to pass or take over health control information betweenformer and new medical institutions.

In other words, if a patient comes from another medical institution tomedical institution 9 to cause a newly registration, the referencehealth control information and health control database with respect tothe patient stored in a host computer of the former medical institutionare taken over by reference biologic information register 23 and centralhealth control database 27 of medical institution 9. On the contrary, ifa patient leaves medical institution 9, the reference health controlinformation and health control database with respect to the patientstored in reference biologic information register 23 and central healthcontrol database 27 are sent to a designated new medical institutionwith the originals are deleted from reference biologic informationregister 23.

However, if the addition, deletion or alteration of patient is notcaused by a patient who changes medical institution, but caused by abirth or death of a patient or change in the family name of a patientupon marriage, the action in step S137 is omitted.

After the action in step S137, the flow advances to step 138. If thereis no addition, deletion or alteration of patient, the flow directlygoes to step S138.

In step S138, it is checked whether or not there is any change inreference information registered in reference biologic informationregister 23, such as addition, deletion or updating of the referenceinformation. If there is any change in the registered referenceinformation, the flow advances to step S139 to modify the registrationin reference biologic information register 23 of host computer 22 toreflect the change in the reference information, and the flow goes tostep S140. On the other hand, the flow directly goes to step 140 ifthere is no change in the reference information.

In step S140, it is checked whether or not there is any change in theregistered request of a registered patient to deliver the statisticsinformation of the patient on the basis of to the central health controldatabase 27, such as addition, deletion or updating of the registereddeliver request. If there is any change in the registered deliverrequest, the flow advances to step S141 to modify the registration ofthe registered request in host computer 22 to reflect the change in theregistered request, and the flow goes to step S142. On the other hand,the flow directly goes to step 142 if there is no change in theregistered request.

In step S142, host computer 22 comes into a condition of waiting thereception of biologic information to be sent from home biologicinformation sensor 13 or commercial grade biologic information sensor 21under the patient agreement. Further in step S143, host computer 22comes into a condition of waiting to start a process of sending variousdata such as the registered reference health information, the result ofdiagnosis, or the statistics information of the patient to his or herpersonal computer in an apartment. And then, the flow terminates thebasic function.

FIG. 12 is a flow chart showing the basic function of host controller 26of host computer 22 relating to the process of sending various data. Theflow of the sending process in FIG. 12 is stated by various trigger withhost controller 22 having come into the condition of waiting in stepS143.

When the sending process is started, it is checked in step S151 whetheror not the trigger is given by new reference health information of apatient is registered at reference biologic information register 23. Ifthe new registration of reference health information has given thetrigger, the flow advances to step S152 to send the newly registeredreference health information to the personal computer of an apartmentwhere the patient lives, and the flow advances to step S153. Forexample, if reference health information of a member of the familyliving in the first apartment is newly registered, host computer 22sends the newly registered reference health information to the firstpersonal computer 5, which in turn stores the received reference healthinformation into reference health information holder 16. On the otherhand, if the trigger is not caused by any new registration of referencehealth information, the flow directly advances to step S153.

In steps S153, it is checked whether or not the trigger is given by newautomatic diagnosis of a patient made by biologic information comparingsoftware 24 on the basis of central health control database 27. If thenew automatic diagnosis has given the trigger, the flow advances to stepS154 to send the new automatic diagnosis to the personal computer of anapartment where the patient lives, and the flow advances to step S155.On the other hand, if the trigger is not caused by any new automaticdiagnosis, the flow directly advances to step S155.

In steps S155, it is checked whether or not the trigger is given by newdiagnosis data of a patient entered by doctor 25 on the basis of centralhealth control database 27. If the new diagnosis data entry has giventhe trigger, the flow advances to step S156 to send the new diagnosis ofdoctor 25 to the personal computer of an apartment where the patientlives.

Next, in steps S135, it is checked whether or not a diagnosis by doctor25 includes an opinion inconsistent with the automatic diagnosis. If thediagnosis by doctor 25 includes some inconsistent opinion, the flowadvances to step S158 to send a warning to the personal computer alongwith the inconsistent opinion by doctor 25 for the patient to note theinconsistency. Thus, the patient can put higher priority on thediagnosis and opinion by doctor 25 than the automatic diagnosis.

Further in steps S159, a process of improving biologic informationcomparing software 24 so as to remove the inconsistency in diagnosis onthe basis of the reason of inconsistency is started, and the flowadvances to step S160.

On the other hand, in step S155, if the trigger is not caused by any newdiagnosis by doctor 25, the flow directly advances to step S160. Thereis no inconsistency of diagnosis in step 157, the flow also directlyadvances to step S160.

In steps S160, it is checked whether or not the trigger is given by newstatistics information created on the basis of to the central healthcontrol database 27 for a patient who has requested the deliver of it.If the new creation of statistics information has given the trigger, theflow advances to step S161 to send the new statistics information alongwith the position of the patient in statistics information to thepersonal computer of an apartment where the patient lives, and the flowof the sending process is terminated. On the other hand, if the triggeris not caused by any new statistics information, the flow is instantlyterminated.

FIG. 13 is a flow chart showing the details of “moving process” in step134 of FIG. 11.

When “moving process” is started, it is checked in step S171 whether ornot the change is a new registration of home biologic information sensor13. If the change is a new registration, the flow advances to step S172to register the new home biologic information sensor 13 into hostcomputer 22 of medical institution 9. Thus, the new home biologicinformation sensor 13 comes under control of host computer 22. In otherwords, the health control information gotten by home biologicinformation sensor 13 is to be processed by host computer 22.

In steps S173, it is checked whether or not medical institution 9 hasalready registered a patient name identifying anyone of the newlyregistered family moving into the apartment where the newly registeredhome biologic information sensor 13 is located. This case is caused forexample by a patient who has already registered his or heridentification into medical institution 9 from the former address nowmoves into the first apartment 2 of condominium building 1 and requiresthe registration of home biologic information sensor 13 through thefirst personal computer 5.

If it is checked in step S173 that medical institution 9 has aregistration identifying one the family, the flow advances to step S174to check whether or not reference biologic information register 23 ofhost computer 22 possibly registers reference biologic information ofthe identified patient. And, if such reference biologic information isregistered, the flow advances to step S175 to send the referencebiologic information to the first personal computer 5, which stores thereceived reference biologic information into reference healthinformation holder 16. After sending the reference information, the flowgoes to step S176. If no reference biologic information is registered,however, the flow goes from step S174 directly to step S176.

In steps S176, it is checked whether or not host computer 22 haspossibly stored the health control information of the identified patientin central health control database 27. And, if such health controlinformation is stored, the flow advances to step S177 to send the healthcontrol information to the first personal computer 5, which stores thereceived health control information into individual health controldatabase 15. Thus received past health control information is useful forthe first personal computer 5 to locally check by itself themoment-to-moment change in the health control information of theidentified patient. After sending the health control information, theflow goes to step S178. If no health control information is stored,however, the flow goes from step S176 directly to step S178.

If the change is not a new registration of home biologic informationsensor 13 in steps S171, the flow directly goes to step S178. Also theflow directly goes from step S173 to step S178 if medical institution 9has no registration identifying anyone of the family moving into theapartment where the newly registered home biologic information sensor 13is located.

I it is checked in step S178 whether or not the change is a deletion ofa registered home biologic information sensor 13. The necessity of suchdeletion will be caused for example by moving of the family out of thefirst apartment 2. If the change is the deletion of a registered homebiologic information sensor 13, the flow advances to step S179 to deletethe registration of home biologic information sensor 13 from hostcomputer 22 of medical institution 9. Thus, the deleted home biologicinformation sensor 13 comes out of control of host computer 22.

Next, in steps S180, host computer 9 sends a reference biologicinformation deleting signal to the first personal computer 5, whichdeletes in response thereto all reference biologic information of themoving family from reference biologic information holder 14. Althoughmedical institution 9 is not to do with the deletion of referencebiologic information from reference biologic information holder 14relating to authentication within condominium building 1 at all, medicalinstitution 9 undertakes such a privacy protection service in “movingprocess” since the reference biologic information is deeply privateinformation relating the same home biologic information sensor 13 whichcovers both admission authentication and health control.

Next in steps S181, it is checked whether or not reference biologicinformation register 23 of medical institution 9 registers referencebiologic information of anyone of the moving family. And, if suchreference biologic information is registered, host computer 22 itselfkeeps the registration within medical institution 9. In step S182,however, host computer 22 sends a reference biologic informationdeleting signal to the first personal computer 5, which deletes inresponse thereto all reference biologic information of the moving familyfrom reference health information holder 16. After sending the referencebiologic information deleting signal, the flow goes to step S183. If noreference biologic information is registered, however, the flow goesfrom step S181 directly to step S183.

In steps S183, it is checked whether or not host computer 9 backs up thehealth control information of all individuals of the moving familywithin central health control database 27. If the health controlinformation is backed up, host computer 22 itself keeps the back upwithin medical institution 9 at central health control database 27. Instep S184, however, host computer 22 sends a health control informationdeleting signal to the first personal computer 5, which deletes inresponse thereto all health control information of the moving familyfrom individual health control database 15. After sending the healthcontrol information deleting signal, the flow goes to the end of “movingprocess”. If there is no back up of health control information of themoving family in central health control database 27, however, the flowgoes from step S183 directly to the end of “moving process”.

If the change is not a deletion of a registered home biologicinformation sensor 13 in step S178, the flow advances to step S185 toupdate the registration of home biologic information sensor 13 since thechange is mere an update of the same home biologic information sensor 13without any new registration nor a deletion thereof in this case.

The first embodiment above has been explained as a case of a condominiumbuilding including a plurality of apartments where a plurality offamilies live in, respectively. However, the system such as in the firstembodiment is not only applicable to the condominium, but also to abuilding containing a plurality of independent companies using a commonentrance, or to a company located at a business place having a commonentrance where a plurality of independent departments work, or the like.

Second Embodiment

FIG. 14 is a block diagram of a biometrics and health controlling systemaccording to a second embodiment of this invention. The secondembodiment does not differ from the first embodiment in that the systemis embodied in a condominium building where a plurality of familiesdomicile. In other words, the second embodiment also relates to a systemfor unlocking authentication both for the common entrance of thecondominium building 1 and for the individual entrance door for thefirst apartment 2 or the like. But, the second embodiment ischaracterized by mobile-phone 101 incorporated in the system. Elementsin condominium building entrance lock control system 8 and medicalinstitution 9 which are common to both the embodiments are given withthe same numeral with their explanation is basically omitted in FIG. 14.

The second embodiment also includes the individual entrance door lockcontrol system for the first apartment 2 or the like. However, since thesystem for the first apartment 2 or the like is identical withcondominium building entrance lock control system 8, the individualentrance door lock control system is not shown in FIG. 14 with itsexplanation omitted for avoiding duplication.

Condominium building entrance lock control system 8 of the secondembodiment includes the first wireless local communication apparatus102, such as Bluetooth (trademark) or wireless LAN or wireless USB.

Administration computer 19 of the second embodiment is in communicationwith the first personal computer 5 in the first apartment 2 or the likeof condominium building 1 as in the first embodiment. Administrationcomputer 19 of the second embodiment is further in communication withmobile-phone 101 through the first wireless local communicationapparatus 102 for controlling entrance lock 20 and for processing healthcontrol information. The other elements of condominium building entrancelock control system 8 in the second embodiment are the same as those inthe first embodiment. If necessary, however, condominium buildingentrance lock control system 8 may further include a first mobile-phonecommunication apparatus not shown.

Medical institution 9 of the second embodiment includes the secondwireless local communication apparatus 103 and the second mobile-phonecommunication apparatus 104. The second wireless local communicationapparatus 103 is governed by same wireless local communication systemthat governs the first wireless local communication apparatus 102. Thesecond mobile-phone communication apparatus 104 is administrated by amobile-phone carrier. The second mobile-phone communication apparatus104 may be replaced by a broadband inter net connector.

Host computer 22 in medical institution 9 of the second embodiment is incommunication with administration computer 19 of condominium buildingentrance lock control system 8 and the first personal computer 5 in thefirst apartment 2 or the like of condominium building 1 as in the firstembodiment. Host computer 22 of the second embodiment is further incommunication with mobile-phone 101 through the second wireless localcommunication apparatus 103 or the second mobile-phone communicationapparatus 104. The other elements of medical institution 9 in the secondembodiment are the same as those in the first embodiment.

In the second embodiment, a person who wants to unlock the entrance lock20 is to approach the entrance of condominium 1 with mobile-phone 101.The authentication system can be triggered by presence sensor 58 sensingthe approach of the person as in the first embodiment. Further in thesecond embodiment, the authentication can also be triggered by the firstwireless local communication apparatus 102 sensing that mobile-phone 101comes into the communication area of the wireless local communicationsystem. The trigger will be actually caused by whichever comes first.

When commercial grade biologic information sensor 21 successfully getbiologic information from an inserted finger, administration computer 19sends the biologic information to mobile-phone 101 by way of the firstwireless local communication apparatus 102. For receiving the biologicinformation, mobile-phone 101 includes the third wireless localcommunication apparatus 105 governed by same wireless localcommunication system that governs the first wireless local communicationapparatus 102.

The third wireless local communication apparatus 105 send tomobile-phone controller 106 the biologic information gotten bycommercial grade biologic information sensor 21. Mobile-phone controller106 compares the received biologic information with reference biologicinformation previously stored in reference biologic information holder107. If the result of the comparison identifies that the person isentitled to enter condominium building 1, mobile-phone controller 106informs the administration computer 19 of the result by way of the thirdwireless local communication apparatus 105 and the first wireless localcommunication apparatus 102.

In response to the informed result, administration computer 19 sends anunlock signal to entrance lock 20. If the received biologic informationdoes not coincides with the reference biologic information on the otherhand, mobile-phone controller 106 informs the administration computer 19of the negative result not to have administration computer 19 send anyunlock signal to entrance lock 20.

As is apparent from the above, administration computer 19 of condominiumbuilding entrance lock control system 8 in the second embodiment has nofunction of storing the reference biologic information or comparing itwith the sensed biologic information, but has a function of beinginformed of the mere result of comparison from mobile-phone 101, whichis similar to the case in the first embodiment. Thus, the referencebiologic information such as the pattern of blood vessel or eye-fundus,which is of high privacy, will not leak out of mobile-phone 101.Further, the feature similar to the first embodiment that administrationcomputer 19 has no function of comparison by itself nor is informed ofwhose mobile-phone sends the comparison result is a good proof ofprotecting privacy.

Similarly to the case in first embodiment, commercial grade biologicinformation sensor 21 in the second embodiment is capable of gettingbiologic information not only for authentication but also for healthcontrol. So, health control through commercial grade biologicinformation sensor 21 is possible also in the second embodiment.

In other words, the biologic information gotten by commercial gradebiologic information sensor 21 and sent to mobile-phone controller 106by way of the first wireless local communication apparatus 102 and thethird wireless local communication apparatus 105 includes health controlinformation such as blood component and blood vessel youth. Mobile-phonecontroller 106, accordingly, compares these health control informationwith the reference health control information of the keeper ofmobile-phone 101, which information is registered in reference healthinformation holder 108.

As in the first embodiment, reference health information holder 108holds not only instantaneous value of the reference information but alsochange in it over time. Thus, mobile-phone controller 101 not onlycompares instantaneous value of the information sent from commercialgrade biologic information sensor 21 with the instantaneous value of thereference information held by reference health information holder 108.But also, mobile-phone controller 101 compares the change in informationsent from commercial grade biologic information sensor 21 and stored inindividual health control database 109 with the reference changeinformation held in health information holder 108. Thus, the healthcontrol is possible also in view of the speed of the change ininformation sensed by commercial grade biologic information sensor 21over time. The results of comparison between the instantaneous values ofinformation and of the comparison between the changes in information aredisplayed on mobile-phone display 110. In case of abnormality as aresult of the comparison, it is advantageous to make a beep toneaccompany the display of abnormality for the keeper of mobile-phone 101to note the mobile-phone display 110.

Mobile-phone 101 further includes user authentication sensor 111 of thesame function as in user authentication sensor 18 of the firstembodiment. Thus, upon user authentication in using conventionalmobile-phone function, it is possible to get biologic information bothfor authentication and for health control.

Mobile-phone 101 also includes health control sensor 112 for sensingbiologic information during the keeper is talking on the phone.Information gotten by health control sensor 112 is also useful forhealth control as well as the information from commercial grade biologicinformation sensor 21 and user authentication sensor 111. Example ofhealth control sensor 112 is a breath component sensor located close tothe microphone or an ear thermometer combined with the speaker orearphone. Health control sensor 112 need not have a function of gettingbiometrics information, but a function of getting only health controlinformation is sufficient.

Mobile-phone 101 is further capable of receiving health controlinformation sent from an outside health control sensor to the thirdwireless local communication apparatus 105 for use the information aswell as health control sensor 112. The outside health control sensor isadvantageously combined with one of various accessories that the keeperor mobile-phone wears, such as a wristwatch, a belt, a pair of glasses,and shoes.

The third wireless local communication apparatus 105 is also capable ofreceiving health information from an outside health control sensor thatdoes not accompany mobile-phone 101, but temporally comes close tomobile-phone, such as a health control sensor incorporated into a chairwith massager.

The third wireless local communication apparatus 105 is still furthercapable of receiving health information from not only the abovementioned outside health control sensor incorporated into a producthaving other primary function, but also from an exclusive use healthcontrol sensor such as an automatic blood pressure monitor located at awaiting lounge of medical institution 9 if such a blood pressure monitorhas the second wireless local communication apparatus 103 to send themonitored blood pressure. The health control information received by thethird wireless local communication apparatus 105 from the additional orexclusive health control sensors as well as commercial grade biologicinformation sensor 21 is stored into individual health control database109. The health control information from user authentication sensor 111and health control sensor 112 within mobile-phone 101 is also storedinto individual health control database 109.

The health control information received through the third wireless localcommunication apparatus 105 and gotten by user authentication sensor 111and health control sensor 112 is utilized without any comparison withthe reference biologic information as well as the utilization though thecomparison explained above. In other words, it is possible to display onmobile-phone display 110 a graph plotting the moment-to-moment change inthe biologic information accumulated in individual health controldatabase 109, such graph including no result of any comparison. Further,the received or gotten health control information as it is without anycomparison can be displayed in real time on mobile-phone display 110.

Such a graph plotting the moment-to-moment change in the biologicinformation or a real time biologic information as it is can bedisplayed on the monitor of television set 17 of the first embodiment inFIG. 1.

Mobile-phone 101 of the second embodiment in FIG. 14 of course includesconventional mobile-phone unit 113 and the third mobile-phonecommunication apparatus 114. Explanation of the conventional function ofthese conventional elements is basically omitted.

Mobile-phone 101 includes a main power switch, which is not shown inFIG. 14, for deactivate conventional function including mobile-phoneunit 113 and the third mobile-phone communication apparatus 114. Thethird wireless local communication apparatus is, however, notdeactivated even if the main power switch is shut down. So, the thirdwireless local communication apparatus 105 is capable of receivinghealth information from the automatic blood pressure monitor located ata waiting lounge of medical institution 9 even if the main power switchis shut down in compliance with the instruction of medical institution9.

The third mobile-phone communication apparatus 114 of mobile-phone 101is administrated by a mobile-phone carrier which can cover communicationwith the second mobile-phone communication apparatus 104. Therefore,mobile-phone 101 can communicate with medical institution 9 far awaythrough internet on mobile-phone or broadband network to exchange healthcontrol information. For example, the contents of individual healthcontrol database 109 can be sent to medical institution 9 in real timefor back up. Or, the reference biologic information, health controlinformation and diagnosis or the like of the keeper of mobile-phone 101can be delivered from medical institution 9 to mobile-phone 101. Thus,mobile-phone 101 has almost the same functions as those of the firstpersonal computer 5 or the like in the first embodiment, the privacyprotection being strictly kept within each keeper of mobile-phone incomparison with the case of the first computer 5 or the like which maybe commonly owned by a plurality of persons in a family.

The information exchange between mobile-phone 101 and medicalinstitution 9 can be made not only through the second mobile-phonecommunication apparatus 104 and the third mobile-phone communicationapparatus 114, but also through the second wireless local communicationapparatus 103 and the third wireless local communication apparatus 105.The latter information exchange is possible when the keeper visitsmedical institution 9 as a patient who wants to make the registration ofits reference biologic information.

The flow of functions carried out by mobile-phone controller 106 in FIG.14 is basically identical with the flow in FIG. 7. In place of step S70in FIG. 7, however, mobile-phone controller 106 prepares for display onmobile-phone display 110 so that an indication of the abnormality is tobe automatically made when its power switch is turned on.

The flow of functions carried out by administration computer 19 ofcondominium building entrance lock control system 8 in FIG. 14 isbasically identical with the flow in FIG. 10. In place of step S117 inFIG. 10, however, administration computer 19 sends the sensed biologicinformation only to the third wireless local communication apparatus 105of mobile-phone 101.

The system including mobile-phone as in the second embodiment in FIG. 14is applicable not only to the unlock authentication system for acondominium building or a building containing a plurality of independentcompanies, but also to a biometrics system for authenticating a personwho is to access money or information, such as a deposit withdrawalhandling system of a bank.

For understanding how to apply the second embodiment in FIG. 14 to adeposit withdrawal handling system of a bank, “deposit withdrawalhandling machine 8” is substituted for “condominium building entrancelock control system 8”, “identical person sensor 21 for deposit account”for “commercial grade biologic information sensor 21”, and “depositwithdrawal admission part 20” for “entrance lock 20” in FIG. 14,respectively.

In FIG. 14 with the above substitutions made, if a person who wants towithdraw money form his or her deposit account is to approach “depositwithdrawal handling machine 8”, the authentication system is triggeredto start communication between the first wireless local communicationapparatus 102 and the third wireless local communication apparatus 105.When the person inserts his or her finger into “identical person sensor21 for deposit account”, the sensed biologic information is sent tomobile-phone 101 for comparison with the reference biologic information.If the result of the comparison identifies that the person is entitledto withdraw money from the own deposit account, mobile-phone controller106 informs the administration computer 19 of the result fortransmission of an admission signal to “deposit withdrawal admissionpart 20”, which makes it possible for the person to withdraw money.Thus, bank itself does not keep the reference biologic information normakes the comparison of the biologic information, the privacy of thereference biologic information is kept within mobile-phone 101.

The biologic information gotten by “identical person sensor 21 fordeposit account” and sent to mobile-phone 101 include not only theauthentication information but also health control information,mobile-phone 101 can utilize it in such a manner of displaying it oraccumulate it or comparing it with reference health control informationin mobile-phone 101. Thus, the bank can provide an additional service ofgetting useful health control information to the original service ofhigh security of biometrics for deposit withdrawal.

Now the detail of the procedure of registering new reference biologicinformation is to be explained.

With respect to the case of the first embodiment, FIG. 15 represents thedetail of the procedure of registering new reference information intoreference biologic information holder 14 of the first personal computer5. If the flow starts, it is checked in step S191 whether or not aregistration of new reference information for unlocking entrance door 10of the first apartment 2 is requested. If the new registration isrequested, the flow advances to step S192 to check whether or not somereference information for unlocking entrance lock 20 of condominiumbuilding 1 is registered in reference biologic information holder 14.

If any reference information for entrance lock 20 is not beenregistered, the flow advances to step S193 to wait biologic informationto be gotten by home biologic information sensor 13. The biologicinformation is to be gotten by inserting a finger of an identifiedperson into home biologic information sensor 13. If the biologicinformation is gotten, the flow advances to step S194 to tentativelyregister the gotten biologic information.

On the other hand, if it is detected in step S192 that some referenceinformation for entrance lock 20 is registered in reference biologicinformation holder 14, the flow directly advances to step S194 totentatively register the biologic information which is a copy of theregistered reference information for entrance lock 20 in referencebiologic information holder 14 since such a registered referenceinformation for entrance lock 20 for condominium building 1 may possiblybe used also as the reference information for entrance door 10 of thefirst apartment 2.

Next, in step S195, it is checked whether or not biologic informationnewly gotten by home biologic information sensor 13 with the finger ofthe identified person inserted for confirmation is identical with thetentatively registered reference biologic information. If theidentification is successful in step S195, the flow advances to stepS196 to formally register into biologic information holder 14 thetentative registration of the reference biologic information. On theother hand, if the identification is failed in step S195, the flowreturns to step S193 to wait new biologic information gotten by homebiologic information sensor 13 with the finger of the identified personinserted again. Thus, the loop of the tentative registration from stepS193 to step S195 is repeated unless the identification is successful instep S195. In the case that the flow comes from step S192 directly tostep S194 with step S193 initially skipped, the flow also enters theloop if the identification is failed in step S195.

After the formal registration of the reference information for entrancedoor 10 of the first apartment 2, the flow advances to step S197. If itis determined in step S191 that any new registration of referenceinformation for unlocking entrance door 10 of the first apartment 2 isnot requested, which means that the formal reference information hasbeen already registered in reference biologic information holder 14, theflow directly advances from step S191 to step S197.

In step 197, it is checked whether or not a registration of newreference information for unlocking entrance lock 20 of condominiumbuilding 1 is requested. If the new registration is requested, the flowadvances to step S198 to wait biologic information to be sent fromadministration computer 19. The reference biologic information is to begotten by inserting a finger of an identified person into commercialgrade biologic information sensor 21 at condominium building entrancelock control system 8. The reference biologic information to be sentfrom administration computer 19 has already been certified bycondominium building entrance lock control system 8. If the biologicinformation is sent from administration computer 19, the flow advancesto step S199 to tentatively register the reference biologic informationreceived from administration computer 19.

Next in step S200, a deletion signal is sent to administration computer19 to delete from administration computer 19 itself the referencebiologic information gotten by commercial grade biologic informationsensor 21. And then, the first personal computer 5 waits deletionconfirmation to be returned by administration computer 19 in step S201.If the confirmation is received in step S201, the flow advances to stepS202 to formally register into biologic information holder 14 thetentative registration of the reference biologic information forunlocking entrance lock 20 of condominium building 1, and theregistration flow is terminated. On the other hand, if the confirmationis failed to be received in step S201, the flow retunes to step S200 tosend the deletion signal again to administration computer 19.

Thus, the deletion the original reference biologic information fromadministration computer 19 is parallel to the formal registration of thetransmitted biologic information at the first computer 5. This meansthat the creation of reference biologic information for entrance lock 20of the condominium building 1 is exclusively possible under the controlof condominium building entrance lock control system 8 for preventingthe reference biologic information form being forged at the firstapartment 2 or the like, and that the keeping of the reference biologicinformation, on the other hand, is exclusively possible under thecontrol of the first apartment 2 for preventing the reference biologicinformation from leaking through condominium building entrance lockcontrol system 8 infringing the privacy. Further, it should be noted,that the original reference biologic information is kept in condominiumbuilding entrance lock control system 8 if the formal registration ofthe received reference biologic information into reference biologicinformation holder 14 is failed.

For the purpose of securing the prevention of the reference biologicinformation form being forged outside condominium building entrance lockcontrol system 8, the biologic information gotten by commercial gradebiologic information sensor 21 is encrypted when sent to the firstpersonal computer 5 or the like. So, the comparison made outsidecondominium building entrance lock control system 8 cannot match realbiologic information originated by condominium building entrance lockcontrol system 8 with any forged biologic information.

In step S197 it is determined that no new registration of the referencebiologic information for condominium building entrance lock controlsystem 8 is requested, the flow is instantly terminated.

In the flow in FIG. 15, the necessity of new registration forauthentication is checked firstly for entrance door 10 of the firstapartment 2, and secondary for entrance lock 20 of condominium building1. The order of check may be reversed. In other words, steps S197 toS202 may precede step 191 in FIG. 15.

With respect to the function flow for controller 12 to newly registerthe reference biologic information for user authentication sensor 18 inFIG. 1 is similar to the flow of step S191 to step S196. However, thesteps should be understood with “user authentication” substituted for“entrance door” in step S191, and “user authentication sensor” for “homebiologic information sensor” in step S193, respectively.

With respect to the function flow for mobile-phone controller 106 of thesecond embodiment in FIG. 14 to newly register the reference biologicinformation into reference biologic information holder 107 is similar tothe entire flow in FIG. 15 with the above substitution in steps S191 andS193 made.

FIG. 16 represents the detail of the procedure of registering newreference information carried out in step S110 in FIG. 9 showing a flowchart showing the basic function of administration controller 53 ofadministration computer 19 located at condominium building entrance lockcontrol system 8. If the flow starts, administration controller 53 instep S211 waits biologic information to be gotten by commercial gradebiologic information sensor 21. The biologic information is to be gottenif an identified person inserts a finger into commercial grade biologicinformation sensor 21 for the purpose of registering the referencebiologic information. If the biologic information is gotten, the flowadvances to step S212 to tentatively keep the gotten biologicinformation.

Next, in step S213, it is checked whether or not biologic informationnewly gotten by commercial grade biologic information sensor 21 with thefinger of the identified person inserted for confirmation is identicalwith the tentatively kept reference biologic information. If theidentification is successful in step S213, the flow advances to stepS214 to send the tentatively kept reference biologic information to thefirst personal computer 5 as the certified reference biologicinformation. On the other hand, if the identification is failed in stepS213, the flow returns to step S211 to wait new biologic informationgotten by commercial grade biologic information sensor 21 with thefinger of the identified person inserted again. Thus, the loop ofgetting certified reference biologic information from step S211 to stepS213 is repeated unless the identification is successful in step S213.

After sending the certified reference biologic information in step S214,administration computer 19 waits the deletion signal from of the firstpersonal computer 5 to delete the reference biologic information kept inadministration computer 9. The deletion signal from the first personalcomputer 5 means an acknowledgement of receipt of the certifiedreference biologic information.

If the deletion signal is received in step S215, the flow advances tostep S216 to delete the kept reference biologic information. And thenthe flow advances to step S217 to send the deletion confirmation to thefirst personal computer 5, and the flow goes to the end. On the otherhand, if the deletion signal is failed to be received in step S215, theflow retunes to step S214 to send the certified reference biologicinformation to the first personal computer 5.

Thus, in the case of unlock authentication of common entrance ofcondominium building 1, the creation of reference biologic informationis made under the control of condominium building entrance lock controlsystem 8 for preventing the reference biologic information form beingforged, while the keeping of the reference biologic information is notmade by condominium building entrance lock control system 8, but by thefirst apartment 2 for preventing infringement of the privacy.

In the case of unlock authentication of individual apartment, on thecontrary, the registration process is simpler since the referencebiologic information gotten by home biologic information sensor 13scarcely leaks out of the first apartment 2.

With respect to the function flow for administration computer 19 of thesecond embodiment in FIG. 14 to newly get the reference biologicinformation at commercial grade biologic information sensor 21 and sentit to reference biologic information holder 107 of mobile-phone 101 issimilar to the flow in FIG. 16. However, the above explanation should beunderstood with “mobile-phone 101” substituted for “the first personalcomputer 5.

In the above embodiments explained with respect to FIGS. 15 and 16, theregistration of the reference biologic information for condominiumbuilding entrance lock control system 8 is made on the basis of theinformation gotten by commercial grade biologic information sensor 21.However, it is theoretically possible to make the registration of thereference biologic information for condominium building entrance lockcontrol system 8 on the basis of the information gotten by home biologicinformation sensor 13 or user authentication sensor 111 if the functionthereof is similar to that of commercial grade biologic informationsensor 21 in terms of getting the reference biologic information forcondominium building entrance lock control system 8.

In this case, however, it is necessary for administration computer 19 tomake the first personal computer 5 under its strict control includingexchange of decryption key or the like for preventing forged referencebiologic information outside condominium building entrance lock controlsystem 8.

Third Embodiment

FIG. 17 is a flow chart relating to a biometrics and health controllingsystem according to a third embodiment of this invention. The blockdiagram of the biometrics and health controlling system according to thethird embodiment is similar to that of the first embodiment. So, theexplanation of the third embodiment is to be made also with FIG. 1 used.In the third embodiment, however, the functions of the first personalcomputer 5 and of administration computer 19 differ from those in thefirst embodiment. In other words, the comparison of the biologicinformation for authentication in condominium building entrance lockcontrol system 8 is made by the first personal computer 5 and the resultof comparison is sent to administration computer 19 in the firstembodiment. In the third embodiment, on the contrary, the comparison ofthe biologic information for authentication is made by administrationcomputer 19 which receives the reference biologic information from thefirst personal computer 5. The details are to be explained with respectto the flow charts in FIGS. 17 and 18.

Controller 12 of the first personal computer 5 in the third embodimentfunctions in accordance with the flow in FIG. 17 in place of the flow inFIG. 7 in cooperation with condominium building entrance lock controlsystem 8.

The authentication flow in FIG. 17 is triggered if the first personalcomputer 5 is informed by administration computer 19 of a person comingto stand in front of the entrance of condominium building 1. If theauthentication is triggered, it is checked in step S221 whether or not apredetermined time has passed after authentication starts. If the timehas not passed yet, the flow advances to step S222 in which it ischecked whether or not the biologic information of the finger gotten bycommercial grade biologic information sensor 21 is received. If nobiologic information is received, the flow goes back to step S221, andsteps S221 and S222 are repeated waiting for the receipt of the biologicinformation of the finger for the predetermined time.

If the receipt of the biologic information of the finger is detected instep S222, the flow goes to step S223 in which the received biologicinformation of the finger is compared with the reference biologicinformation stored in reference biologic information holder 14. Itshould be noted that the comparison in step S223 is not for unlockauthentication for entrance lock 20 of condominium building 1, but forconfirmation that the finger is of one of the family living in the firstapartment 2. If the received biologic information coincides with thereference biologic information, the flow advances to step S224 to sendto administration computer 19 the reference biologic information storedin reference biologic information holder 14. The unlock authenticationhereinafter including the comparison process is left to administrationcomputer 19.

Thus, the determination of the receipt of the biologic information instep 222 and its comparison in step S222 constitute the cause to send toadministration computer 19 the reference biologic information stored inreference biologic information holder 14. In other words, only oneapartment if any can send the reference biologic information.

Upon sending the reference biologic information in step S224, it isconcealed from administration computer 19 that the reference biologicinformation is sent from the first personal computer 5 so thatadministration computer 19 cannot identify whose reference biologicinformation is sent.

Next, in step 225, it is checked whether or not commercial gradebiologic information sensor 21 succeeds in getting sufficientinformation for health control. In other words, it is checked whether ornot the biologic information received from administration computer 19 issufficient as the health control information. A case of failure in stepS225 means that the biologic information received from administrationcomputer 19 is sufficient for the purpose of confirmation of identity,but is insufficient for the purpose of health control.

If it is judged that in step S225 that biologic information receivedfrom administration computer 19 is sufficient as the health controlinformation, the flow advances to step S226 in which the receivedbiologic information is stored into individual health control database15. The information stored in individual health control database 15 isalso sent to host computer 22 in real time for the storage in centralhealth control database 27 according to a contract with medicalinstitution 9. This means that the information in individual healthcontrol database 15 is backed up by central health control database 27,which makes it easy for moving out of condominium building 1 withoutlosing individual health control database.

The above mentioned contract with medical institution 9 to send thehealth control information to host computer 22 in real time for thestorage in central health control database 27 serves as a care systemfor solitary old people for example. Since the health controlinformation is automatically sent to medical institution 9 every timewhen an inhabitant successfully goes through the entrance of thecondominium building 1 according to such a contract, medical institution9 can sense no passage of the inhabitant through the entrance ofcondominium building 1 for a considerable period of time by means of nosending of the health control information for the period of time. Thus,medical institution 9 can take necessary step as soon as it senses suchan abnormal life pattern of the inhabitant.

Next, in step S227, it is checked whether or not reference biologicinformation exists in reference health information holder 16. If thereis any reference biologic information, the flow advances to step S228 inwhich the received biologic information is compared with the referencebiologic information in reference health information holder 16. And, theflow goes to step S229 to judge whether the result of comparison showany abnormality of health control information. If some abnormalitydetected, the flow advances to step S230 to prepare for display ontelevision set 17 so that an indication of the abnormality is to beautomatically made when its power switch is turned on, and the flow goesto step S231. If there is no abnormality judged in step S229, the flowdirectly goes to step S231.

In step S231, the comparison result is gotten in step S228 is stored inindividual health control database 15. The information stored inindividual health control database 15 in step S231 is also sent to hostcomputer 22 in real time for the storage in central health controldatabase 27. The abnormality judged in step S229 is also sent to hostcomputer 22 in real time for the storage in central health controldatabase 27.

By way of the above steps, the flow comes to step S232 to check againwhether or not a predetermined time has passed after the authenticationstarts. The meaning of step S232 is similar to that of step S72 in FIG.7.

If it is detected in step S227 that there is no reference biologicinformation in reference health information holder 16, the flow goes tostep S232 by way of step S235 since there is no necessity of carryingout steps S228 to S231. In step 235 in this case, the fact that there isno reference biologic information in reference health information holder16 is sent to administration computer 19, which is the reason why stepsS228 to S231 have not been carried out.

In step S233, the first personal computer 5 comes into a condition ofwaiting the deletion confirmation from administration computer 19reporting that the reference biologic information sent from the firstpersonal computer 5 has been deleted from administration computer 19,and the flow goes to the end of authentication process. In other word,the authentication process will not end unless the deletion confirmationcomes from administration computer in step S233 for preventing privacyviolation.

On the other hand, if it is determined that the received biologicinformation is insufficient as the health control information, the factis sent to administration computer 19 in step S234, the reason of whichis also sent in step S235 prior to getting to step S232.

In step S221, if the predetermined time has passed after theauthentication starts without insertion of a finger into commercialgrade biologic information sensor 21, the flow instantly goes to theend.

In step S223, if the received biologic information does not coincidewith the reference information stored in reference biologic informationholder 14, the flow instantly goes to the end without sending anyreference biologic information to administration computer 19 since thereceived biologic information from administration computer 19 has norelation to the family in the first apartment 2. Of course, the healthcontrol process of steps S225 to S231 is unnecessary since the receivedbiologic information is of a complete stranger in this case. Further,the first personal computer 5 does not inform administration computer 19of the result of comparison made in step S223 in this case since theresponsibility of authentication for unlocking the entrance ofcondominium building 1 is not on the personal computer 5, but onadministration computer 19.

Administration controller 53 of the administration computer 19 in thethird embodiment in FIG. 3 functions in accordance with the flow in FIG.18 in place of the flow in FIG. 10.

The authentication flow in FIG. 18 is triggered if administrationcomputer 19 detects a person coming to stand in front of the entrance ofcondominium building 1. If the authentication is triggered, it ischecked in step S241 whether or not a predetermined time has passedafter authentication is triggered. If the time has not passed yet, theflow advances to step S242 in which it is checked whether or not afinger is inserted into commercial grade biologic information sensor 21.If no finger is inserted, the flow goes back to step S241, and stepsS241 and S242 are repeated waiting for the insertion of a finger for thepredetermined time.

If the insertion of a finger is detected in step S242, the flow goes tostep S243 in which the sensed biologic information from the finger issent to all the apartments joining condominium building entrance lockcontrol system 8. And, in step S244 it is checked whether or notreference biologic information is received from any of the apartmentswhich detects that the sent biologic information coincides withreference biologic information. If it is determined in step 244 thatreference biologic information is received from one of the apartments,the flow advances to step S245.

It should be noted that administration computer 19 does carry out thecomparison in the third embodiment. In other words, administrationcomputer 19 compares in step S245 the reference information having beenreceived in step 244 and the biologic information sensed by commercialgrade biologic information sensor 21. If both the biologic informationcoincide with each other in step S245, the flow goes to step S246.

In step S120, it is checked whether or not administration computer 19 isinformed of a failure of getting health control information by any ofthe apartments.

If no failure information is received from any apartment in step 246,the flow advances to step S247 to direct entrance lock 20 to unlock theentrance door. Entrance lock 20 unlocks the entrance door in response tothe direction.

In receiving information in steps S244 to S246, administration computer19 is blocked from identifying a specific apartment that sends thereference biologic information and the failure information for thepurpose of privacy protection.

After the direction to entrance lock 20, the flow advances to step S248to delete the biologic information which has been gotten in step S242.This is to secure privacy protection. And, the flow advances to step 249to check again whether or not a predetermined time has passed after theperson comes to stand in front of the entrance of condominium building 1to trigger the authentication. If the time has passed, the flow goes tostep 250 to delete the reference biologic information having beenreceived in step S244 and to inform all the apartments of the deletionconfirmation, and then administration computer 19 terminates theauthentication flow.

On the other hand, in step S246 if it is checked that administrationcomputer 19 is informed of a failure of getting health controlinformation by any of the apartments, the flow advances to step S251 todisplay the fact of failure, the reason of failure being also displayedin step S252 prior to getting to step S247. Thus, also in condominiumbuilding entrance lock control system 8, the direction is made towardentrance lock 20 to unlock the entrance door of condominium building 1even if it is failed to get health control information in the apartment.

If it is checked in step S241 that the predetermined time has passedafter the person comes to stand in front of the entrance of condominiumbuilding 1 without any insertion of a finger into commercial gradebiologic information sensor 21, the flow advances to step 253 to displayadmission refusal indication. Further, the indication of the reason ofrefusal is displayed in step S254, the reason being the non-insertion ofa finger in this case. And then, the flow goes to step S255.

In step S255, auxiliary conventional authentication system such aspassword system or IC card system is made available to check whether ornot such an auxiliary conventional authentication is successful. It theauxiliary conventional authentication is successful, the flow advancesto step S247 to unlock entrance lock 20. If the auxiliary conventionalauthentication is not made or unsuccessful, the flow finally goes to theend by way of steps S248 to S250, entrance lock 20 being not unlocked.With only this case taken into consideration, step S247 may seem to haveno meaning since there is no necessity of deleting any biologicinformation which has not been gotten in first place. However, step S248is located at the position shown in FIG. 18 for protecting privacy whichmay be caused by the reason referred to below or by other unexpectedaccidental reasons.

If no reference biologic information is received in step S244 from anyapartment in reply to the sending of the gotten biologic information instep S243, the flow goes to step S253 to display admission refusalindication, the display of the reason of refusal following in step S254.

Similarly in step 245, if the received reverence biologic informationdoes not coincide with the biologic information gotten by commercialgrade biologic information sensor 21, the flow goes to step S253 todisplay admission refusal indication, the display of the reason ofrefusal following in step S254.

In both the case above, the flow advances to step S255 to make availablethe auxiliary conventional authentication system such as password systemor IC card system. And, if the auxiliary conventional authentication issuccessful in step S255, the flow goes to step S247 direct entrance lock20 to unlock the entrance door. If the auxiliary conventionalauthentication is not made or unsuccessful in step S255, on thecontrary, the flow goes to step S248 to delete the biologic informationwhich has been gotten in step S242. Thus, even if the authentication isunsuccessful, there is sometimes necessary to delete the gotten biologicinformation for securing privacy protection.

In this case, if the predetermined time has not passed yet in step S249,the flow retunes to step S242 by way of step S241. So, it is possible togo to step S243 by way of step S242 if the person more carefully insertsthe finger again with the indication made in step S254 taken intoconsideration.

In any case above, the flow gets to step S250 by way of step S249. Inthe case that the flow gets to step S253 from step S241 directly or fromstep S244, however, nothing seems to be carried out in step S250 sincethere has not been any reference biologic information received in firstplace. However, the flow is so arranged to go through step S250 withoutfail for protecting privacy violation which may be otherwise caused bysome unexpected accidents.

Fourth Embodiment

The fourth embodiment is a modification of the embodiment in FIG. 14including mobile-phone 101 in which the comparison of the biologicinformation for authentication is modified to be made by administrationcomputer 19 as in the third embodiment. The block diagram of the fourthembodiment is similar to that of the embodiment in FIG. 14. So, theexplanation of the third embodiment is to be made also with FIG. 14used. The function of mobile-phone controller 106 of mobile-phone 101and the function of administration controller 63 of administrationcomputer 19 can be mostly understood on the basis of FIG. 17 and FIG.18, respectively, duplicate explanation thereof being accordinglyomitted with only different steps commented on.

In the fourth embodiment, step S223 can be omitted from the flow in FIG.17. In other words, the third embodiment checks in step S223 where ornot the received biologic information of the finger coincides with thereference biologic information stored in reference biologic informationholder 14 since there is no necessity of sending reference biologicinformation to administration computer 19 if the received biologicinformation from administration computer 19 has no relation to thefamily in the first apartment 2. In the case of the fourth embodiment,on the contrary, it is necessary without question to send referencebiologic information 19 from mobile-phone 101 to administration computer19 since the biologic information received from administration computer19 is of the mobile-phone keeper who stands in front of the entrance ofcondominium building 1 with his or her finger inserted into commercialgrade biologic information sensor 21. Thus, the flow can go from stepS222 directly to step S224 in the case of the fourth embodiment.

Further in the case of the fourth embodiment, mobile-phone controller106 prepares in step S230 to display an indication of abnormalitywarning on mobile-phone display 110, in place television set 17, so thatthe indication is to be automatically made when its power switch ofmobile-phone 101 is turned on.

Also in the flow of FIG. 18 administration computer 19 of the fourthembodiment in step S243 sends the gotten biologic information only tothe third wireless local communication apparatus 105 of mobile-phone101, in place of the personal computers in all the apartments.

Further in the case of the fourth embodiment, a step of is insertedbetween step S242 and step S243 in FIG. 18 to check whether or not themobile-phone keeper is a user of “health control contract”. And, theflow can go from step S242 to step S243 through the inserted step onlywhen the mobile-phone keeper is the user. If the mobile-phone keeper isnot the user, on the contrary, the flow goes from the inserted step tostep S244 by way of a step of requesting the mobile-phone 101 to sendthe reference biologic information to administration computer 19. Thus,administration computer 19 determines whether or not to send the gottenbiologic information to a mobile-phone in dependence on whether or notthe mobile-phone is kept by a user of “health control contract”. Theabove explanation of the function of mobile-phone controller 106 isbased on the assumption that the keeper of mobile-phone 101 is a user of“health control contract”.

In the case that the keeper of mobile-phone 101 is not a user of “healthcontrol contract”, on the other hand, the function of mobile-phonecontroller 106 is very simple, the explanation of which is made on FIG.17 with necessary modification commented below. In other words, themodification is that a step labeled with “reference information request”is substituted for step S222, and that step S223, steps S225 to S231,step S234 and step S235 are omitted. Thus, in the case that the keeperis not a user of “health control contract”, mobile-phone 101 simplysends the reference biologic information to administration computer 19and confirms the deletion of the same from administration computer 19.

Next, the process of checking the sensor is to be explained. Since thesensor checking process is common to the first to the fourth embodiment,the explanation is made on the first embodiment for example.

FIG. 19 is a flow chart showing the details of step 12 in FIG. 4. If theflow starts, it is checked in step S261 whether or not home biologicinformation sensor 13 is changed. If the sensor is changed, the flowgoes to step S262 to get output of home biologic information sensor 13with no finger inserted. And then, the flow waits in step S263 for theinsertion of a finger on a trial basis, the flow advancing to step S264if the finger is inserted to cause output form home biologic informationsensor 13.

In step 264, a basic signal check is done in which it is checked whetheror not a sufficient output is gotten with the finger inserted inreference to the output gotten without the finger insertion. If anyabnormality is detected on such a basic signal check, the flow goes tostep S265 to make a basic adjustment, the flow going to step S266 oncompletion of such a basic adjustment. If there is no abnormalitydetected in step S264, on the contrary, the flow goes directly to stepS266.

In step S266, a cross check signal is sent both to home biologicinformation sensor 13 and to commercial grade biologic informationsensor 21. And, in step S267, it is checked whether the output of homebiologic information sensor 13 corresponds to that of commercial gradebiologic information sensor 21. If any inconsistency exists between theoutputs in step S267, the flow goes to step S268 to make a cross checkadjustment, in which the output level of the home biologic informationsensor 13 is adjusted to come to an adequate level relative to theoutput level of commercial grade biologic information sensor 21. Andthen, the flow goes to step S269. If there is no inconsistency detectedin step S267, on the contrary, the flow goes directly to step S269. Ifany change of home biologic information sensor 13 is not detected instep S261 at all, the flow also goes step S269.

In step S269, it is checked whether or not a predetermined period oftime has passed since the latest regular check. The regular check may bedone very often on a relatively short periodic base. If it is determinedin step S269 that the predetermined period of time has passed tonecessitate a regular check, the flow goes to step S270 to make apredetermined items of regular check. For example the similar crosscheck to those done in steps S266 and S267 in which the cross checksignal is sent both to home biologic information sensor 13 and tocommercial grade biologic information sensor 21 to checked whether ornot a sufficient output is gotten from home biologic information sensor13 without the finger inserted in reference to the output gotten fromcommercial grade biologic information sensor 21 without the fingerinsertion. If any abnormality is detected in step S270, the flow goes tostep S271 to make a suitable regular adjustment procedure, the flowgoing to step S272 on completion of such a regular adjustment procedure.If there is no abnormality detected in step S270, on the contrary, theflow goes directly to step S272. If it is determined in step S269 thatthe predetermined period of time has not passed yet, the flow goesdirectly to step S272. ether or not all the adjustments automaticallydone in steps S265, S268 and S271 have been successful. If any of theautomatic adjustment is not successful, the flow goes to step S273 toprepare for display on television set 17 so that an indication of theabnormality is to be automatically made when its power switch is turnedon, and the flow goes to the end. The function relating to step S273 forthe display on television set 17 is similar to that in step S70.

The details of the process of checking the sensor by administrationcomputer 19 in step S111 in FIG. 9 is basically similar to FIG. 19.However, the cross check process in steps S266 to S268 is unnecessary asto the function of administration computer 19. It should be noted thatadministration computer 19 carries out the regular check in steps S270and S271 for commercial grade biologic information sensor 21 only.Further, administration computer 19 displays the indication of theabnormality on its own monitor in place of preparing for display ontelevision set 17 in step S273.

Thus, the check and adjustment of commercial grade biologic informationsensor 21 is done by administration computer 19. The first personalcomputer 5 believes in such a check and adjustment of commercial gradebiologic information sensor 21 by administration computer 19 to carryout the cross check and adjustment of home biologic information sensor13 in reference to commercial grade biologic information sensor 21.

Next, the past information comparison process is to be explained indetail. Since the past information comparison process is common to thefirst to the fourth embodiment, the explanation is made on the firstembodiment for example.

FIG. 20 is a flow chart showing the details of past informationcomparison process of step 84 in FIG. 8. If the flow starts, it ischecked in step S281 whether or not biologic information form differentkinds of sensors, outputs of which are combinable with each other inanalysis, are stored in individual health control database 15. If suchbiologic information from a plurality of different kinds of sensors arestored, the flow goes to step S282 to prepare these biologic informationfor comparison in combination, the flow going to step S283 after thepreparation. If it is determined in step 281 that no biologicinformation of a sensor combinable with other biologic information of adifferent kind of sensor is stored, on the contrary, the flow goesdirectly to step S283.

The different kinds of sensors, outputs of which are combinable witheach other in analysis are, for example, a blood vessel sensor, afunduscopic sensor, and a vocal print sensor, or the like, which are allcapable of getting both authentication information and health controlinformation. Such a combination of biologic information from a pluralityof kinds of sensors is advantageous not only in reducing error inauthentication, but also in achieving an advanced health control.

In step S283, it is checked whether or not biologic information not ofauthentication but of physical condition of a person to be authenticatedby means of other biologic information is stored. If such biologicinformation is stored, the flow advances to step S284 for arrangingthese information to be combined for comparison, the flow going to stepS285 after the arrangement function in step 284. If such biologicinformation is not stored, on the contrary, the flow directly advancesto step S285. For example, the biologic information not ofauthentication but of condition of a person to be authenticated is bodytemperature, blood pressure and frequency of pulse, or the like.

Other than the above, examples of the biologic information not ofauthentication but of condition of a person to be authenticated is hefourth embodiment are as follows.

As a first example, a pedometer can be incorporated into mobile-phone101 including individual health control database 109. In this case, notonly a condition of a person at the moment of authentication, but alsoan exercise history until the moment of authentication can be gotten bypedometer and stored in individual health control database 109. In otherwords, even if the frequency of pulse at the moment of authenticationare identical between two cases, the first case after walking exercisecontinued in one month and the second case after no exercise for thecorresponding one month can be distinguished from each other incomparison of the gotten biologic information with the referencebiologic information to diagnose the health condition on the result ofcomparison. Thus, an exercise history is a good example of the biologicinformation not of authentication but of condition of a person to beauthenticated.

Further, the biologic information not of authentication but of conditionof a person to be authenticated is not limited to the information of theperson himself or herself, but also that of his or her family is useful.For example, even if the blood pressures are identical between twopersons at the moment of authentication, the first person from a familyof hypertension history and the second person from a family of normalblood pressure can be distinguished from each other in comparison of thegotten biologic information with the reference biologic information todiagnose the health condition on the result of comparison.

Medical institution 9 registers the reference biologic information withvarious conditions such as mentioned above in accordance with a decisionof biologic information comparing software 24 or doctor 25. Thus, thenecessary manner of comparison including combination of informationdepends on what reference information is registered solely or incombination in medical institution 9.

In step S285, is it is checked whether or not information relating tooutside circumference influencing directly on the biologic informationor indirectly on a person from which the biologic information is to begotten. If such information is stored, the flow advances to step S286for arranging these information to be combined for comparison, the flowgoing to step S287 after the arrangement function in step 286. If suchbiologic information is not stored, on the contrary, the flow directlyadvances to step S287.

For example, information relating to outside circumference is climatecondition such as temperature, humidity and wind velocity, which aregotten by outside circumference sensor 57 in FIG. 3.

In step S287, it is checked whether or not time information is stored,the time information relating to a time when the biologic information,condition of the person to be authenticated and the outsidecircumference are gotten, respectively. If the time information isstored, the flow advances to step S288 to pick up the biologicinformation, physical condition information and the outsidecircumference information at same time every day among the accumulationof those information in individual health control database 15, thepicked up information at same time every day being prepared forcomparison with each other. Especially, the authentication informationgotten from a person at the time of getting into office every morning bya biologic information sensor located at the entrance of the office is agood example of the biologic information having time informationregularly accumulated every day without fail.

Next, in step S289, the biologic information, physical conditioninformation and the outside circumference information gotten at varioustime of a same day are picked up among the accumulation of thoseinformation in individual health control database 15, the picked upinformation of the same day being prepared for comparison with eachother to analyze the change in the information from morning till night.

After carrying out steps S288 and S289, the flow advances to step 290.If it is determined in step S287 that time information is not stored atall, on the contrary, the flow directly goes to step S290.

In step S290, it is checked whether or not the biologic information,physical condition information of the person to be authenticated andinformation of the outside circumference each with date have beenaccumulated for a predetermined meaningful long term such as one season.If such long term information have been accumulated in individual healthcontrol database 15, the flow advances to step S291 to prepare analysisof change in season of the biologic information, physical conditioninformation and the outside circumference information, and then flowadvancing to step S292. Since the biologic information is possiblyinfluenced by the change in season, steps S291 is useful to analyze thecorrelation of the change in the biologic information and the transitionof the season. If it is determined in step 290 that the biologicinformation with date information have not been accumulated yet for thepredetermined meaningful term, on the contrary, the flow directlyadvances to step S292.

In step S292, it is checked whether or not the biologic information,physical condition information for the person to be authenticated andinformation of the outside circumference each with date have beenaccumulated for a predetermined term meaningful for analyzingmoment-to-moment change since the similar analysis was done in thelatest term. If such information have been accumulated in individualhealth control database 15, the flow advances to step S293 to prepareanalysis of the moment-to-moment change in the biologic information,physical condition information and the outside circumferenceinformation, and then flow advancing to step S294. If it is determinedin step 292 that the biologic information with date information have notbeen accumulated yet for the predetermined term, on the contrary, theflow directly advances to step S294. This is because that the rate ofchange in the information is important for moment-to-moment changeanalysis to detect abnormality of health. So, the flow directly goesfrom step S292 to step S294 if a time passed since the end of the latestterm is insufficient to analyze the rate of moment-to-moment change inthe biologic information.

In step S294, various analyses including the comparison between thegotten and accumulated biologic information, between those and thereference biologic information, and between combinations of variousinformation are carried out on the basis of the preparation done insteps S282, S284, S286, S288, S289, S291 and S293.

FIG. 21 is a schematic view of a structure of an entrance door commonlyused for the first to fourth embodiments. FIG. 21 shows a cross-sectionof entrance door 10 with the left side thereof corresponding to outsideof the first apartment 2 while the right side of entrance door 10corresponds to the inside such as entrance hall. Elements shown in FIG.14 basically correspond to door lock 11, home biologic informationsensor 13 and a part for informing a person outside entrance door 10 ofthe admission refusal or the failure of getting health controlinformation, respectively.

In detail, entrance door 10 includes on the outside thereof electronicname plate 201 formed of an electronic paper, which normally displaysthe family name. Electronic name plate 201 is under control of the firstpersonal computer 5 by way of control circuit 202 located insideentrance door 10 to temporarily display the admission refusal or thefailure of getting health control information in place of the familyname as occasion arises.

Control circuit 202 also forms home biologic information sensor 13 alongwith common light source 203 and common light sensor 204, home biologicinformation sensor 13 of the above structure being under control of thefirst personal computer 5. Door knob and lock mechanism 205 along withcontrol circuit 202 forms door lock 11, which is under control of thefirst personal computer 5.

FIG. 21 schematically shows the communication lines running in or out ofcontrol circuit 202 as if they are cables exposed in the entrance hall.Of course, the communication lines are practically wired within entrancedoor 10 to be hidden from the eye.

Door knob and lock mechanism 205 includes door knob to be touched foropening and closing entrance door 10 and the lock mechanism. The doorknob is operable at both the inside and the outside. However, the lockmechanism cannot be unlocked at the outside unless the unlocking signalcomes under control of the first personal computer 5 or someone manuallyunlocks it by rotating the door knob at the inside.

Common light source 203 and common light sensor 204, which are locatedon the opposite sides of door knob and lock mechanism 205, cooperate toget biologic information both at the inside and the outside of entrancedoor 10. In other words, a finger can naturally be inserted betweencommon light source 203 and common light sensor 204 for detection of thebiologic information in any one of both cases of touching the door knobat the outside and at the inside.

Thus, if a person really entitled to enter the first apartment 2 comesto the outside of entrance door 10 to touch door knob and lock mechanism20, the biologic information is naturally gotten from the finger of theperson and immediately authenticated to automatically unlock door knoband lock mechanism 20. This series of process is carried out so quicklythat the person can operate the door knob to open entrance door 10 as ifit is not locked.

On the other hand, if a person touches door knob and lock mechanism 20at the inside to go out of entrance door 10, it can be manually unlockedwithout need of authentication. In this case, however, the biologicinformation itself is naturally gotten from the finger of the persontouching door knob and lock mechanism 20. Thus, the biologic informationcan be regularly gotten every morning without fail when the person goesto daily work.

Now the explanation is directed to the detailed structure of commonlight source 203 and common light sensor 204. Common light source 203includes light emitter 206 located at the inside of entrance door 10 foremitting light toward the inside door knob. Light emitter 206 also emitslight toward the outside of entrance door 10, which light in turn isbended downward by upper light guide 207 toward the outside door knob.Thus, only one emitter 206 can illuminate both the inside door knob andthe outside door knob.

Common light sensor 204 includes light receiver 208 located at theinside of entrance door 10 for receiving light by way of a fingertouching the inside door knob. The light emitted downward from the exitof upper light guide 207 goes through a finger touching the outside doorknob to incident lower light guide 209, which light in turn is bendedrightward by lower light guide 209 toward the light receiver 208. Thus,only one light receiver 208 can receive light by way of both a fingertouching the inside door knob and a finger touching the outside doorknob.

Common light source 203 and common light sensor 204 are not onlyadvantageous in that the biologic information can be gotten both at theinside and at the outside of entrance door 10 by means of one pair oflight emitter 206 and light receiver 208, but also advantage for thefollowing reason.

In other words, light emitter 206 and light receiver 208 as well ascontrol circuit 202 are located at the inside of entrance door 10, whichis advantageous in that these elements having a higher proportion of thecost of the entire system are protected from being damaged or vandalizedfrom the outside. Thus, upper light guide 207 and lower light guide 209serve as a protector similar to protection unit 52 in FIG. 3. Upperlight guide 207 and lower light guide 209 are replaceable or adjustableindependently form light emitter 206 and light receiver 208 as in thecase of protection unit 52 in FIG. 3.

The above advantage of the structure for preventing main elements frombeing exposed to outside environment is also true in the embodiment inwhich the comparison of the biologic information for authentication isnot carried out by the first personal computer 5 inside entrance door10, but left to administration computer 19.

The light path from the light exit to the light entrance of the homebiologic information sensor 13 is exposed to outside environment to bepossibly interrupted by dust adhering to the light exit or the lightentrance, or by a foreign matter sandwiched in between the light exitand the light entrance. So, the light path including the light exit andthe light entrance have to be always maintained clean for the sensing ofthe biologic information not to be impossible or insufficient.

The structure in FIG. 21 is advantageous in that door knob and lockmechanism 205 is mechanically moved by a hand every time theauthentication of a person is required. In other words, the light exitand the light entrance can be cleaned by a mechanical wiper every timeupon authentication if the wiper is so arranged to be driven inconjunction with the movement of the door knob. As to a foreign matterpossibly being sandwiched in between the light exit and the lightentrance is expected to be naturally removed by a hand to touch the doorknob.

Of course, the wiper can be electrically driven by a regularly actuatedmotor in place of being manually driven in conjunction with the movementof the door knob.

Fifth Embodiment

FIG. 22 is a chart showing a data structure for authentication andhealth control for the fifth embodiment. In the fifth embodiment, allthe authentication information and health control information areintegrated into one data format shown in FIG. 22 in contrast to thefirst to fourth embodiments in which various information are separatelystored in reference biologic information holder 14, individual healthcontrol database 15 and reference health information holder 16, or thelike. The first to fourth embodiments, however, can be easily modifiedso as to be practiced according to the integrated data format as in thefifth embodiment.

According to the integrated data format of the fifth embodiment, alldata are basically integrated into one data format so as to beadministrated as one file. The integrated data file consists of personalidentification file 301, health control data file 302, related conditiondata file 303 and medical institution data file 304, which can beindependently administrated and also be integrally administrated bymeans of relation code parts 305 to 308 of data files 301 to 304,respectively, the same unique code being allotted to all the relationcode parts 305 to 308 in the same integral data file.

Personal identification file 301 includes basic data 309 for identifyinga person, such as name, address and phone number, attribution data 310to the person such as gender and birth day, local reference biologicdata 311 for authenticating the entrance door of the apartment, andcommon reference biologic data 312 for authenticating the entrance ofthe condominium building.

All data in personal identification file 301 other than common referencebiologic data 312 can be registered by the user himself, while commonreference biologic data 312 can not be registered on the user's own, butcan be registered only under the control of a common system such asadministration computer 19 of entrance lock control system 8. On theother hand, medical institution 9 cannot access to local referencebiologic data 311 and common reference biologic data 312 which have norelation to health control, but to unlock authentication exclusively.

When common reference biologic data 312 is sent to condominium buildingentrance lock control system 8 for the purpose of authentication, basicdata 309 capable of identifying a person, such as name, address andphone number, attribution data 310 to the person such as gender andbirth day and local reference biologic data 311 for authenticating theentrance door of the apartment are concealed so that condominiumbuilding entrance lock control system 8 cannot know whose commonreference biologic data 312 is sent.

Health control data file 302 includes individual health control database313 for storing biologic information with date and time when theinformation is gotten, 15, physical condition database 314 for storingbiologic information not of authentication but of condition of a personwhen the biologic information for authentication is gotten, outsidecircumference data base 315 for storing outside circumferenceinfluencing on the person when the biologic information is gotten, andcomparison result database 316 for storing the result of comparison.

The authentication system such as condominium building entrance lockcontrol system 8 cannot access health control data file 302. If a personis to access his or her own health control data file 302, it isnecessary for the person to have his or her biologic informationcompared with local reference biologic data 311 for authentication.Thus, a stranger cannot access such health control database 302 ofanother.

Related condition data file 303 includes exercise history data 317 forstoring a record by pedometer for example and family clinical historydata 318 for storing clinical history of the family other than theclient.

Authentication system such as condominium building entrance lock controlsystem 8 cannot access related condition data file 303. If a person isto access his or her own related condition data file 303, it isnecessary for the person to have his or her biologic informationcompared with local reference biologic data 311 for authentication.Thus, a stranger cannot access such related condition data file 303 ofanother.

Medical institution data file 304 includes various data to be treatedunder administration of medical institution 9. Medical institution 9,however, cannot access health control data file 302 since medicalinstitution 9 is not a person itself nor has any relation to localreference biologic data 311 and common reference biologic data 312 ofthe person. So, for the purpose of making it possible for medicalinstitution 9 to access health control data file 302, health controlpassword 319 is given to be stored in Medical institution data file 304under authorization of the patient. Thus, doctor 25 can access healthcontrol data file 302 by inputting health control password 319.

Other than health control password 319, medical institution data file304 includes medical institution identification code 320, referencebiologic information 321 for health control and doctor diagnosis data322, which are under administration of medical institution 9, even apatient himself or herself being incapable of modifying them on its own.

Reference biologic information 321, which has been registered in medicalinstitution data file 304 is automatically transmitted to the firstpersonal computer 5 or to mobile-phone 101 in general. The transmissionof doctor diagnosis data 322 is, however, postponed until apredetermined prosecution has been completed. This is because anotification of a serious disease should be sometimes done verycarefully.

As has been discussed above, the biometrics deeply relates to thecontradiction between the issue of the forgery of biologic informationand the issue of infringement of privacy through the biologicinformation. The embodiments according to this invention are for solvingthe contradiction. The following modification of the second embodimentis also useful for solving the contradiction, the explanation of themodification being made in accordance with FIG. 14.

The modification includes a second commercial grade biologic informationsensor under the administration by condominium building entrance lockcontrol system 8. The second commercial grade biologic informationsensor is separable from condominium building entrance lock controlsystem 8 for the purpose of creating the reference biologic information.Upon creation of the reference biologic information, in more detail, thesecond commercial grade biologic information sensor completely isolatedfrom condominium building entrance lock control system 8 is connected tomobile-phone 101 of the keeper who comes to an office where condominiumbuilding entrance lock control system 8 is located. And, the biologicinformation gotten from the second commercial grade biologic informationsensor with a finger of the keeper inserted is input into mobile-phone101 to be encrypted into a first encrypted reference biologicinformation according to a mobile-phone encryption system under thecontrol of mobile-phone controller 106.

The first encrypted reference biologic information is sent tocondominium building entrance lock control system 8 by way of the thirdwireless local communication apparatus 105 and the first wireless localcommunication apparatus 102. The received first encrypted referencebiologic information is further encrypted into a second encryptedreference biologic information according to an unlock encryption systemunder the control of administration controller 20. The second encryptedreference biologic information is sent back to mobile-phone 101 by wayof the first wireless local communication apparatus 102 and the thirdwireless local communication apparatus 105. The received secondencrypted reference biologic information is finally stored intoreference biologic information holder 107.

Thus, the second encrypted reference biologic information is of a natureincapable of being created by the mobile-phone keeper by itself becauseof the necessity of the unlock encryption system exclusively controlledby administration controller 20 as well as incapable of being decryptedby condominium building entrance lock control system 8 because of themobile-phone encryption system exclusively controlled by mobile-phonecontroller 106. Further, condominium building entrance lock controlsystem 8 cannot access to the raw biologic information since the secondcommercial grade biologic information sensor is completely isolated fromadministration condominium building entrance lock control system 8 upongetting the reference biologic information. On the other hand, anyone isincapable of creating the reference biologic information unless he orshe comes to the office where condominium building entrance lock controlsystem 8 is located, since mobile-phone 101 is only be allowed to beconnected to the second commercial grade biologic information sensor atthe office.

Upon authentication, in the case of comparison at mobile-phone 101,biologic information gotten by commercial grade biologic informationsensor 21 is encrypted into a first encrypted gotten reference biologicinformation according to the unlock encryption system under control ofadministration controller 20. The first encrypted gotten biologicinformation is sent to mobile-phone 101 by way of the first wirelesslocal communication apparatus 102 and the third wireless localcommunication apparatus 105. At mobile-phone 101, the encrypted gottenbiologic information is encrypted into a second encrypted gottenbiologic information according to the mobile-phone encryption systemunder control of mobile-phone controller 106. The second encryptedgotten biologic information is compared with the second encryptedreference biologic information stored in reference biologic informationholder 107. Since the second encrypted gotten biologic information andthe second encrypted reference biologic information both are encryptedthrough both the unlock encryption system and the mobile-phoneencryption system, the order of the encryption having no influence onthe resultant encrypted biologic information, the second encryptedgotten biologic information coincides with the second encryptedreference biologic information if the origin of raw gotten biologicinformation is the same as that of the raw reference biologicinformation.

If the second encrypted gotten biologic information coincides with thesecond encrypted reference biologic information, mobile-phone 101 sendsthe unlock command signal to condominium building entrance lock controlsystem 8 by way of the third wireless local communication apparatus 105and the first wireless local communication apparatus 102 within a veryshort period directed by administration command from administrationcomputer 19. Administration computer 19 cannot identify the keeper sincethe unlock signal includes no biologic information.

The followings are not any limitations, but summarization of variousfeatures of this invention for example:

1. A biometrics system comprising a first part including a firstsub-part for administrating the registration of a reference biologicinformation and a second sub-part for utilizing a result of a biometricsrecognition, and a second part including a third sub-part for holdingthe reference biologic information registered under the administrationby the first sub-part.

2. The biometrics system according to feature 1, wherein the first partis commonly utilized by a plurality of persons, while the second part isindividually utilized by an identified person.

3. The biometrics system according to feature 2, wherein the first partis incapable of holding the reference biologic information.

4. The biometrics system according to feature 2 or 3 wherein the firstpart is a lock control system for an entrance door commonly utilized bya plurality of persons, and wherein the second sub-part is capable ofunlocking the common entrance door depending on a result of thebiometrics recognition.

5. The biometrics system according to feature 4, wherein the second partis administrated by an identified person who utilizes the entrance door.

6. The biometrics system according to feature 5, wherein the second partis held by an individual person who utilizes the common door.

7. The biometrics system according to feature 1, wherein the first partis a bank system for authenticating a customer of the bank and thesecond sub-part is capable of authenticating the customer depending on aresult of a biometrics recognition.

8. The biometrics system according to any of features 1 to 7, whereinthe second part is a mobile-phone.

9. The biometrics system according to feature 1, wherein the first partfurther including a fourth sub-part for getting the reference biologicinformation and a fifth sub-part for transmitting the reference biologicinformation to the second part.

10. The biometrics system according to feature 9, wherein the firstsub-part is capable of deleting form the first part the referencebiologic information which has been gotten by the fourth sub-part andthen held by the third sub-part.

11. The biometrics system according to feature 10, wherein the firstsub-part is incapable of deleting the reference biologic informationfrom the first part unless the reference biologic information gotten byfourth sub-part has been held by the third sub-part.

12. The biometrics system according to one of features 9 to 11, whereinthe second part further includes a sixth sub-part for transmitting thereference biologic information held by the third sub-part back to thefirst part upon authenticating a person.

13. The biometrics system according to feature 12, wherein the fourthsub-part is also capable of getting biologic information uponauthenticating the person.

14. A biometrics system according to feature 13, wherein the fifthsub-part is also capable of transmitting the authentication biologicinformation gotten by the fourth sub-part to the second part, whereinthe second part further including a seventh sub-part for comparing thetransmitted authentication biologic information with the referencebiologic information held by third sub-part, and wherein the sixthsub-part is also capable of transmitting to the first part the result ofthe comparison by the seventh sub-part as a biometrics recognition to beutilized by the second sub-part.

15. The biometrics system according to feature 13, wherein the sixthsub-part is capable of transmitting the reference biologic informationto the first part, wherein the first part further includes an eighthsub-part for comparing the transmitted reference biologic informationwith the authentication biologic information which has been gotten bythe fifth sub-part, and wherein the second sub-part is capable ofutilizing the result of the comparison by the seventh sub-part asbiometrics recognition.

16. The biometrics system according to one of features 1 to 8, whereinthe second part further includes a ninth sub-part for getting thereference biologic information, the second part being underadministration by the first sub-part in getting the reference biologicinformation with the ninth sub-part and in holding the same in the thirdsub-part.

17. A biometrics system comprising a first part for administrating theregistration of a reference biologic information, a second part forutilizing a result of a biometrics recognition, and a third part forreceiving information relating to the reference biologic informationwhen a biometrics recognition is required.

18. The biometrics system according to feature 17, wherein the system isincapable of holding the reference biologic information which has beenregistered under control of the first part.

19. The biometrics system according to feature 17 or 18, wherein thesystem is a lock control system of an entrance door commonly utilized bya plurality of persons, wherein the second part is capable of unlockingthe common entrance door depending on a result of the biometricsrecognition.

20. The biometrics system according to one of features 17 to 19, furthercomprising a fourth part for getting the reference biologic informationand a fifth part for transmitting the reference biologic information.

21. The biometrics system according to feature 20, wherein the first iscapable of deleting the reference biologic information gotten by thefourth part after the reference biologic information has beentransmitted by the fifth part.

22. The biometrics system according to feature 21, wherein the fourthpart is also capable of getting authentication biologic information whena biometrics recognition is required.

23. The biometrics system according to feature 22, wherein the fifthpart is capable of transmitting the authentication biologic informationgotten by the fourth part, and wherein the second part is capable ofutilizing, as the result of the biometrics recognition, the informationrelating to the reference biologic information received by the thirdpart in response to the transmission of the authentication biologicinformation by the fifth part.

24. The biometrics system according to feature 22, further comprising asixth part for comparing the reference biologic information received bythe third part with the authentication biologic information gotten bythe fourth part, and wherein the second part is capable of utilizing asthe result of the biometrics recognition the result of the comparison bythe seventh part.

25. The biometrics system according to feature 22, wherein the fourthpart is exchangeable apart from the second part, and wherein thebiometrics system further comprises a seventh part for checkingoperations of an newly exchanged fourth part.

26. A biometrics system comprising: a first part for holding a referencebiologic information, and a second part for transmitting informationrelating to the reference biologic information held by the first partwhen a biometrics recognition is required.

27. The biometrics system according to feature 26, wherein the referencebiologic information held by the first part is for unlocking a doorcommonly utilized by a plurality of persons, and wherein the biometricssystem is under control of a particular person utilizing the commondoor.

28. The biometrics system according to feature 27, wherein thebiometrics system is capable of being held by the particular personutilizing the common door.

29. The biometrics system according to feature 26, wherein the referencebiologic information held by the first part is for use in a personauthentication system of a bank, and wherein the biometrics system isunder control of an individual bank customer.

30. The biometrics system according to feature 26, wherein thebiometrics system is constituted as a mobile-phone.

What is claimed is:
 1. A building entrance biometrics system commonlyutilized by predetermined persons, for authenticating a person to accessthe building entrance through a comparison between biologic informationgotten by the person and registered reference biologic information ofthe person comprising: a biologic information sensor, which is providedin the building entrance biometrics system, arranged to sense thebiologic information of the person to be authenticated; anadministrator, which is provided in the building entrance biometricssystem, arranged to administrate the registration of the referencebiologic information of the person sensed by the sensor in the buildingentrance biometrics system, the registered reference biologicinformation being used in comparison with the biologic informationsensed by the biologic information sensor upon authenticating the personto access the building entrance; a transmitter, which is provided in thebuilding entrance biometrics system, arranged to transmit the registeredreference biologic information obtained from the biologic informationsensor in the building entrance biometrics system to an apartment withinthe building under private control by the person to have the apartmentwithin the building store the registered reference biologic information;a lock control system for the building entrance commonly utilized by aplurality of persons, the lock control system being arranged to unlockthe building entrance in accordance with the authentication; and acontroller arranged to delete the registered reference biologicinformation to be used in coming authentication from the buildingentrance biometrics system after the transmission of the registeredreference biologic information to the apartment, whereby the registeredreference biologic information to be used in coming authentication isisolated from the biometrics system, wherein apartment is underindividual control of one of the plurality of persons utilizing thebuilding entrance.
 2. The building entrance biometrics system accordingto claim 1 further comprising a second transmitter arranged to transmitto the apartment a biologic information gotten from a person, a receiverarranged to receive a result of comparison between the transmittedbiologic information and the registered reference biologic informationfrom the apartment for the lock control system to unlock the buildingentrance in accordance with the result of comparison received by thereceiver.
 3. The building entrance biometrics system according to claim1, wherein the transmitter includes a wireless local communicationapparatus.
 4. The building entrance biometrics system according to claim1 further comprising an encryption system utilized by the administratorin administrating the registration of the reference biologic informationof the person to form an encrypted reference biologic information, theencrypted reference biologic information being transmitted to and storedby the apartment, wherein the transmitter is further arranged totransmit to the apartment the biologic information of the person sensedby the sensor with the encryption system utilized to form an encryptedbiologic information, whereby the encrypted biologic information gottenform the person and the encrypted reference biologic information arecompared at the apartment.
 5. The building entrance biometrics systemaccording to claim 1 further comprising a biologic information storagein the apartment including: a receiver arranged to receive the referencebiologic information from the transmitter; a storage part arranged tostore the received reference biologic information; and a communicatorfor utilizing the reference information upon authentication for theunlock of the entrance.
 6. A building entrance biometrics systemcommonly utilized by predetermined persons, for authenticating a personto access the building entrance through a comparison between biologicinformation gotten by the person and registered reference biologicinformation of the person comprising: a biologic information sensorwhich is provided in the building entrance biometrics system, arrangedto sense biologic information of the person to be authenticatedincluding biometrics information and health control information; atransmitter, which is provided in the building entrance biometricssystem, arranged to transmit the biologic information sensed by thesensor in the building entrance biometrics system to an apartment withinthe building to have the apartment store the biologic information as thehealth control information; and a lock control system for the buildingentrance commonly utilized by a plurality of persons, the lock controlsystem being arranged to unlock the building entrance in accordance withthe authentication, wherein the apartment is under individual control ofone of the persons utilizing the building entrance, and wherein a levelof sufficiency of the biologic information in case of storage by theapartment as the health condition information which is usedindependently from the authentication differs from that in case of theauthentication by the biometrics system so that the biometrics systemmay complete authentication even if the level of the biologicinformation is insufficient to store in the apartment.
 7. The buildingentrance biometrics system according to claim 6, wherein the storage inthe apartment is under control of a medical institution.
 8. The buildingentrance biometrics system according to claim 6, wherein the transmitteris arranged to transmit the biologic information to the apartment whenthe biometrics system succeeds in authenticating the person on the basisof the biologic information sensed by the sensor.
 9. The buildingentrance biometrics system according to claim 8, wherein the transmitteris arranged to transmit the biologic information to the apartment underprivate control by the person authenticated through the biologicinformation.